Misdirected Email Incident Response Guide for Medical Imaging AI Companies

A misdirected email can expose protected health information (PHI) through an attachment, a message body, or details in an imaging file. Medical imaging AI companies should respond quickly: contain access, preserve evidence, assess the information and its safeguards, and coordinate with the covered entity or business associate involved.

Identify the Misdirected Email and Exposed Imaging Data

Confirm what was sent, to whom, when, and whether the recipient opened, downloaded, forwarded, or otherwise accessed it. Preserve the original message and relevant mail-system records while limiting further access to the content.

Review both the email and its attachments. Imaging data can contain identifiers in DICOM headers and other imaging metadata identifiers, such as a patient’s name, date of birth, medical record number, accession number, or study dates. Information in the message body, filenames, screenshots, or image pixels may also identify a patient or connect the imaging to their care.

Determine whether the information identifies a person and relates to their health, care, or payment for care. Record the number of people potentially affected, the types of data involved, and any other information that could make re-identification possible.

Contain the Disclosure and Contact the Recipient

Contact the unintended recipient promptly using a verified communication channel. Ask them not to open, use, save, copy, or forward the email or its attachments; to delete the message and any downloaded copies; and to confirm in writing what they did and when.

If return is more appropriate than deletion, use a secure, approved method. Do not ask the recipient to send the imaging data back through ordinary email. A deletion or recall request can help mitigate the incident, but it does not by itself establish that no one accessed the information or that notification is unnecessary.

Preserve the message, delivery and access logs, timestamps, recall or containment actions, and the recipient’s response. Notify your privacy or security lead and the appropriate covered entity contact under your incident-response procedures and business associate agreement.

Assess the HIPAA Breach and Encryption Status

Document a HIPAA breach risk assessment for any impermissible disclosure of unsecured protected health information. HIPAA generally presumes such a disclosure to be a breach unless the covered entity or business associate establishes a low probability that the PHI was compromised, or an applicable exception applies. The assessment considers the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how effectively the risk was mitigated.

Check whether the data was encrypted in a manner that meets HHS guidance and whether the decryption key or process was also exposed. Encryption may mean the PHI is not “unsecured” for breach-notification purposes only if it meets the applicable standard and remains inaccessible to the unintended recipient. Ordinary email protections or a password sent alongside an attachment should not be assumed to meet that standard without technical verification.

Record the evidence supporting the conclusion, including recipient assurances, access logs, containment measures, and the status of any encryption keys. If the company cannot substantiate that notification is unnecessary, escalate the decision to privacy counsel or the responsible covered entity.

Define Business Associate and Covered Entity Duties

Identify each organization’s role in the specific data flow. A medical imaging AI company may be a business associate if it creates, receives, maintains, or transmits PHI on behalf of a covered entity; its obligations depend on the services provided and the applicable agreement. A company handling imaging data outside a covered entity’s or business associate’s behalf may have a different legal status, so assess the relationship rather than relying on the company’s label.

Review the business associate agreement for reporting procedures, required notice timing, information to provide, and who will coordinate communications. A business associate that discovers a breach of unsecured PHI must notify the covered entity; the agreement may set a shorter reporting period than HIPAA’s outer limit. The covered entity remains responsible for required notices to affected individuals and government authorities, though it may delegate certain tasks to the business associate.

Meet HIPAA Breach Notification Deadlines

Document the breach discovery date and start the notification analysis promptly. Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a reportable breach. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, subject to any shorter timeframe in the agreement.

For HHS breach reporting, a covered entity generally must report breaches affecting 500 or more individuals without unreasonable delay and within 60 days after discovery. Breaches affecting fewer than 500 individuals may generally be reported annually, no later than 60 days after the end of the calendar year in which they were discovered. A breach affecting more than 500 residents of a state or jurisdiction also triggers notice to prominent media serving that area. Confirm the affected-person count and applicable deadlines with the responsible covered entity.

Prepare notification details early, including what happened, the types of information involved, steps individuals can take to protect themselves, and the response actions being taken. Keep a record of notices sent—or of the documented analysis supporting a decision that notice is not required.

Preserve Investigation Evidence and Records

Maintain a secure incident file with the original email and attachments, message headers, mail-system and access logs, relevant imaging-system records, a timeline, the recipient’s statements, containment steps, and communications with the covered entity. Preserve records according to your retention policies and any applicable legal hold, and restrict access to personnel who need them for the investigation.

Document the risk assessment, the decision about notification, supporting evidence, and deadlines and responsibilities under the business associate agreement. A clear record helps demonstrate how the company evaluated the disclosure, mitigated risk, and met its reporting duties.

In short, identify the exposed imaging data, contain access, assess whether unsecured PHI was compromised, coordinate responsibilities with the covered entity, meet applicable deadlines, and preserve a defensible investigation record.

FAQs

What imaging data can make a misdirected email a HIPAA breach?

An email may expose PHI if it contains information that identifies a person and relates to their health, care, or payment for care. Identifiers may appear in the message, filenames, DICOM headers, imaging metadata, or image pixels. Whether the disclosure is a reportable breach depends on the circumstances, including whether the information was unsecured and the outcome of the required assessment.

How should a company request deletion or return of a misdirected email?

Contact the recipient through a verified channel, ask them not to access, use, copy, or forward the information, and request deletion of the message and any downloaded copies—or secure return if appropriate. Ask for written confirmation and details about any access or onward disclosure. Preserve the request and response, and do not treat a deletion promise as a substitute for assessing the incident.

How does encryption affect breach notification obligations?

If the PHI was encrypted according to applicable HHS guidance and the key or decryption process was not compromised, it may qualify as secured PHI rather than unsecured PHI for breach-notification purposes. Verify how the data was protected at the time it was sent and whether the recipient could access it; encryption alone does not settle the analysis in every situation.

When must affected individuals and federal authorities be notified?

For a reportable breach of unsecured PHI, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. HHS reporting is generally due within 60 days for breaches affecting 500 or more people; breaches affecting fewer than 500 may generally be reported annually, within 60 days after the end of the calendar year. The covered entity is responsible for required notices, although it may delegate notification work to a business associate.