Unauthorized Screen Scraping at a Chiropractic Billing Clearinghouse: Incident Response Checklist

Unauthorized screen scraping can expose patient details through a billing platform even when no database export is obvious. A clearinghouse should contain the activity, preserve evidence, assess the protected health information (PHI) involved, and coordinate promptly with the chiropractic providers it serves.

This checklist addresses HIPAA response steps. Contract terms and applicable state laws may impose additional or earlier reporting duties, so involve privacy and legal counsel as the facts develop.

How should a clearinghouse contain unauthorized screen scraping?

Treat suspected scraping as a security incident while you determine what happened. HIPAA requires regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes, as described in the Security Incident Procedures standard, 45 CFR 164.308(a)(6).

• Activate the incident response plan and assign an incident lead. Bring in security, privacy, operations, and legal personnel as appropriate.
• Disable or restrict the suspected scraper’s account, terminate active sessions, and revoke affected passwords, tokens, API keys, or other credentials. Require secure credential resets where warranted.
• Block confirmed malicious traffic or access paths, and temporarily suspend affected integrations or automated processes if needed to stop ongoing access. Consider claims-processing continuity before broad service restrictions.
• Preserve relevant logs and system data before taking actions that may overwrite or destroy them. Isolate affected systems when necessary, but avoid wiping or rebuilding them before forensic needs are considered.
• Monitor for new accounts, repeat login attempts, unusual queries, or continued access through other credentials or connected services.

Containment actions should be documented with their times, owners, and operational effects. The specific technical steps are incident-response measures; the HIPAA Security Rule requires an appropriate response but does not prescribe one universal containment sequence.

What logs and evidence should teams preserve?

Preserve evidence that can show who accessed the platform, what they could see or retrieve, and whether data left the environment. HHS guidance identifies collecting and preserving relevant log files and other artifacts as an important incident-response activity; the Security Rule also calls for review of information-system activity such as audit logs and access reports.

• Identity and access records: authentication and single sign-on logs, MFA events, session histories, password or token changes, account creation, and privilege changes.
• Application and claims activity: screen views, searches, patient or claim lookups, downloads, exports, edits, and access by account, organization, and time.
• Network and infrastructure records: web application firewall, proxy, VPN, DNS, firewall, endpoint detection, cloud, database, and API gateway logs, where available.
• Third-party evidence: records from vendors, hosting providers, identity services, or connected billing and practice-management systems that may have handled the activity.
• Incident artifacts: relevant alerts, screenshots or recordings, system images, scripts or tools recovered, and analyst notes explaining how each item was collected.

Preserve original records in a restricted, tamper-resistant location where feasible. Record timestamps and time zones, collection methods, custodians, transfers, and integrity checks such as hashes. Limit access to evidence, particularly when it contains PHI.

For additional guidance on evidence collection, log review, and response activities, see the HHS OCR cybersecurity newsletter on Security Incident Procedures.

How can teams assess whether protected health information was accessed or disclosed?

Build a timeline and map the scraper’s activity to the clearinghouse’s systems and records. Identify which accounts and organizations were involved, the period of access, the pages or functions reached, and the patient or claim records and fields potentially exposed. In a chiropractic billing environment, relevant data may include identifiers, claim details, diagnosis or procedure information, and payment or insurance information.

Distinguish between a login attempt, a screen or record actually viewed, a query that returned data, and information downloaded or transmitted elsewhere. Review application and database events, network traffic, endpoint artifacts, and any available scraper or vendor records. Lack of a recorded export alone does not establish that information was not viewed or otherwise accessed.

For an impermissible use or disclosure of unsecured PHI, HIPAA generally presumes a breach unless an exception applies or the organization demonstrates a low probability that the PHI was compromised through a documented risk assessment. HHS describes the required assessment factors as the nature and extent of the PHI, the unauthorized person, whether PHI was actually acquired or viewed, and the extent of mitigation. See the HHS OCR guidance on the HIPAA breach risk assessment.

Assess whether the information was unsecured under HHS guidance, including whether any encryption key or process was compromised. Document uncertainty and the basis for estimates; do not treat incomplete logs as proof that no PHI was accessed. A security incident does not automatically mean a reportable breach, but the organization should document why notification is or is not required.

How should a clearinghouse coordinate with covered healthcare providers and response teams?

If the clearinghouse handles PHI on behalf of chiropractic practices, it may be acting as a business associate. Follow the business associate agreement (BAA) and incident-response terms, and notify each affected covered entity promptly with the known facts—even while the investigation continues.

Under 45 CFR 164.410, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The BAA may require an earlier notice or require reporting of security incidents before a breach determination is complete; HHS explains that parties may specify stricter reporting terms in their business associate agreement provisions.

Give providers a usable, regularly updated incident summary that identifies, to the extent possible, affected individuals and the types of information involved. Coordinate on the affected population, risk assessment, notification responsibilities, response to patient inquiries, and any additional state-law or contractual requirements.

• Establish a shared incident contact and a secure channel for exchanging updates and evidence.
• Coordinate the clearinghouse’s technical investigation with each provider’s privacy and compliance teams.
• Involve qualified forensic specialists, outside counsel, relevant vendors, and cyber-insurance contacts as appropriate.
• Clarify in writing which party will prepare and send notices; a covered entity may delegate notice tasks to its business associate, but the parties should follow the governing agreement and applicable HIPAA responsibilities.

What HIPAA breach notifications are required and when?

For a reportable breach of unsecured PHI at or by a business associate, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is the federal outside deadline, not a reason to wait: the BAA may set a shorter deadline, and the facts may call for earlier reporting. The business associate should provide available details and continue supplementing the report as information becomes available.

The covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery under 45 CFR 164.404. The covered entity must also notify the HHS Secretary under 45 CFR 164.408. For incidents affecting 500 or more individuals, the HHS notice is due without unreasonable delay and no later than 60 calendar days; for incidents affecting fewer than 500, the covered entity may report annually, no later than 60 days after the end of the calendar year in which the breach was discovered. HHS provides instructions on submitting breach reports to the Secretary.

HIPAA’s discovery rules generally start the clock when the breach is known or would have been known through reasonable diligence, subject to the rule’s terms. Do not postpone assessing deadlines solely to wait for a final count or complete forensic report. A business associate may submit a report to HHS on a covered entity’s behalf, but the parties should confirm that arrangement and who is accountable for each notice.

When are media notices required and what should individual notices include?

A covered entity must notify prominent media outlets serving a state or jurisdiction when a breach involves more than 500 residents of that state or jurisdiction. The notice is due without unreasonable delay and no later than 60 calendar days after discovery, and its content must meet the individual-notice requirements in 45 CFR 164.406. The threshold is based on residents of a state or jurisdiction, not simply the total number of people affected across all locations.

Individual notices under 45 CFR 164.404 should be written in plain language and include, to the extent possible:

• A brief description of what happened, including the breach and discovery dates if known.
• The types of unsecured PHI involved.
• Steps individuals can take to protect themselves from potential harm.
• A brief description of the investigation, mitigation, and measures to help prevent further breaches.
• Contact procedures for questions or additional information, such as a toll-free number, email address, website, or postal address.

Individual notice is generally sent by first-class mail, or by email if the person has agreed to electronic notice and that agreement remains in effect. If contact information is insufficient or outdated, HIPAA requires substitute notice reasonably calculated to reach the person; the method depends in part on whether fewer than 10 or 10 or more people lack usable contact information. The HHS Breach Notification Rule overview summarizes these requirements.

How should teams document incident closeout and corrective actions?

Maintain a clear incident record from detection through closure. Include the discovery timeline, affected systems and organizations, preserved evidence, investigation methods, scope estimates, PHI exposure assessment, mitigation steps, and the rationale for the HIPAA breach risk assessment and notification decisions.

Record which covered entities were notified and when, the information supplied to them, who was assigned each notification task, and any notice dates and submission confirmations. If the conclusion is that notification is not required, retain the supporting risk assessment and the facts or exceptions relied upon. HHS explains that regulated entities must be able to document that required notifications were made or why notification was not required.

Closeout should also identify root causes and corrective actions, such as credential controls, session management, monitoring, vendor oversight, or changes to access permissions. Assign each action an owner and completion date, verify that it worked, and update response procedures based on lessons learned. Apply the applicable documentation-retention rules; for Security Rule documentation, the HHS Security Rule summary describes the six-year retention requirement for required policies, procedures, and records.

In short, a strong closeout ties containment and evidence to a documented PHI assessment, timely provider coordination, defensible notification decisions, and verified corrective actions.

FAQs.

What should a chiropractic billing clearinghouse do first after detecting unauthorized screen scraping?

Activate the incident response plan, stop ongoing unauthorized access by disabling affected accounts or sessions and revoking relevant credentials or tokens, and preserve logs and other evidence. Notify affected covered healthcare providers in line with the BAA and keep the investigation, containment, and claims-processing continuity coordinated.

How can the clearinghouse determine whether protected health information was accessed or disclosed?

Correlate identity, application, claims, database, network, and endpoint records to establish what the scraper could reach and what it actually viewed, queried, downloaded, or transmitted. Identify the PHI and people potentially involved, document evidence gaps, and conduct the HIPAA risk assessment using the required factors.

When must affected individuals and federal authorities be notified?

The business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery, subject to any shorter BAA deadline. The covered entity generally notifies affected individuals by the same federal outside deadline; it reports to HHS within that period for breaches affecting 500 or more individuals, while breaches affecting fewer than 500 may be reported annually, no later than 60 days after the calendar year ends.

When is a media notice required?

A covered entity must notify prominent media outlets serving a state or jurisdiction when a breach affects more than 500 residents of that state or jurisdiction. The notice is due without unreasonable delay and no later than 60 calendar days after discovery.