Healthcare Incident Response Plan — Template + Tabletop Exercise

A healthcare incident response plan is the written procedure a HIPAA covered entity uses to identify, respond to, mitigate, and document security incidents involving PHI. The requirement lives at 45 CFR § 164.308(a)(6) — a required, not addressable, administrative safeguard. The plan must cover detection, response, mitigation, documentation, and post-incident review.

What HHS actually requires

The Security Incident Procedures standard at 45 CFR § 164.308(a)(6)(i) is one sentence: Implement policies and procedures to address security incidents. The required implementation specification at (a)(6)(ii) adds: Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.

Three definitional anchors matter. Security incident at § 164.304 is broader than breach at § 164.402 (the FAQ above breaks this out). The contingency plan at § 164.308(a)(7) is a parallel — but separate — required standard that addresses business continuity rather than incident response.

The federal frameworks that inform what an effective plan looks like: NIST SP 800-61 Rev. 3 (Incident Response Recommendations and Considerations for Cybersecurity Risk Management — April 2024, superseding the withdrawn Rev. 2); NIST SP 800-30 Rev. 1 (Guide for Conducting Risk Assessments); and NIST SP 800-66 Rev. 2, the 2024 update to the HIPAA Security Rule cybersecurity resource guide. Rev. 3 reframes the lifecycle around continuous-improvement risk management activities — Preparation, Detection and Analysis, Containment and Recovery, and Post-Incident Activity — rather than the strictly linear four-phase model of the withdrawn Rev. 2.

The breach notification side lives in a separate subpart: §§ 164.400 through 164.414. OCR's breach reporting portal is the channel for HHS notification.

Template — incident response plan (copy-ready)

The template below maps the NIST SP 800-61 Rev. 3 lifecycle to the § 164.308(a)(6) requirements. We file this version in client binders.

``` HEALTHCARE INCIDENT RESPONSE PLAN [Practice Name] Effective: [DATE] Reviewed annually.

1. PURPOSE AND SCOPE

This plan satisfies 45 CFR § 164.308(a)(6) by establishing how this practice identifies, responds to, mitigates, and documents security incidents involving ePHI. It applies to every workforce member, contractor, and business associate.

1. DEFINITIONS

Security Incident — per 45 CFR § 164.304: the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations.

Breach — per 45 CFR § 164.402: the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule, which compromises the security or privacy of the PHI.

1. ROLES AND CONTACTS

Security Officer (incident commander): [Name] / [phone] / [email] / [after-hours phone]

Privacy Officer: [Name] / [phone] / [email]

Practice Owner / Executive: [Name] / [phone] / [email]

External IT / MSP: [Vendor] / [contact] / [phone] / [SLA reference]

Breach counsel: [Firm] / [attorney] / [phone] / [retainer status]

Cyber insurance carrier: [Carrier] / [policy #] / [claim hotline]

Forensic / DFIR firm (pre-vetted): [Firm] / [contact] / [phone]

EHR vendor incident contact: [Vendor] / [support tier] / [phone]

External reporting:

• HHS OCR breach portal: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
• FBI IC3: https://www.ic3.gov
• State Attorney General: [contact for each applicable state]
• State breach-notification authority: [contact]

1. PHASE 1 — PREPARATION

• Maintain the contact list above; verify quarterly.
• Maintain pre-vetted DFIR retainer or carrier-provided panel.
• Confirm cyber insurance policy is current; understand the

notification window required by the carrier (often 24-72 hours).

• Maintain offline backups per the contingency plan

(45 CFR § 164.308(a)(7)); test restore quarterly.

• Run one tabletop exercise per year (see Appendix A).

1. PHASE 2 — DETECTION AND ANALYSIS

Detection triggers (non-exhaustive):

• EHR or PM system alert
• User report of suspicious behavior, lockout, or unfamiliar email
• Endpoint protection alert
• Email rule that the user did not create (BEC indicator)
• Lost or stolen device or paper record
• Vendor notification of a breach affecting the practice
• Ransom note or encrypted-file extension change

On detection, the discovering workforce member:

1. Does not power off the affected device.
2. Disconnects the device from the network (unplug Ethernet,

disable Wi-Fi) but leaves it powered on to preserve memory state.

1. Notifies the Security Officer within 1 hour of discovery.
2. Logs the discovery time, device, and observed indicators on

the Incident Intake Form (Appendix B).

The Security Officer:

1. Confirms the incident is in scope (PHI-bearing system, workforce

member, or facility involved).

1. Activates this plan; opens an Incident Record per Appendix B.
2. Begins the breach risk assessment timer (60-day discovery clock

starts at the moment of discovery, not at the moment of confirmation).

1. Notifies the Privacy Officer, Practice Owner, and IT/MSP within

2 hours.

1. Notifies cyber insurance within the carrier's required window.

1. PHASE 3 — CONTAINMENT, ERADICATION, AND RECOVERY

Containment (first 24 hours):

• Isolate affected systems from the network.
• Disable affected user accounts; force credential reset for

potentially compromised accounts.

• Preserve volatile state (memory, network state) before any

eradication step that would destroy evidence.

• Engage DFIR if scope exceeds internal capability.

Eradication:

• Remove malicious files, accounts, and persistence mechanisms.
• Patch the entry vector if identified.
• Validate that no additional compromised systems remain.

Recovery:

• Restore from known-good offline backups per the contingency plan.
• Validate restored data integrity before returning to production.
• Monitor restored systems for at least 14 days post-recovery.

1. PHASE 4 — POST-INCIDENT ACTIVITY

Within 14 days of recovery:

• Complete the four-factor breach risk assessment

(45 CFR § 164.402): (i) nature and extent of PHI involved; (ii) the unauthorized person; (iii) whether PHI was actually acquired or viewed; (iv) extent to which risk has been mitigated.

• Document the breach determination with rationale.
• If breach determined, notify per §§ 164.404, 164.406, 164.408.
• File an after-action report (Appendix C).
• Update risk analysis (§ 164.308(a)(1)(ii)(A)) with the new

finding.

• Update controls, training, and policies as needed.

1. NOTIFICATION DECISION MATRIX

Affected individuals discovered | Notify within (HIPAA) ----------------------------------|----------------------- < 500 individuals | Individuals within 60 days; | HHS via annual log within 60 | days after calendar-year end | (45 CFR § 164.408(c)) ≥ 500 in a single state/jurisdiction| Individuals + media + HHS | within 60 days Business Associate detected first | BA must notify covered entity | within 60 days of discovery | (45 CFR § 164.410)

1. TESTING

Run one tabletop exercise per year using a documented scenario. Maintain the after-action report for at least six years. Update the contact list quarterly; verify after every workforce change.

1. RETENTION

This plan, every Incident Record, and every after-action report are retained for at least six years per 45 CFR § 164.316(b)(2)(i). ```

Tabletop exercise script (Appendix A)

We use the script below with clients running their first tabletop. Total runtime 30-45 minutes. Documented and filed even if the runtime is shorter.

``` TABLETOP EXERCISE — RANSOMWARE SCENARIO

Attendees: Security Officer, Privacy Officer, Practice Owner, one clinical staff member, one front-desk staff member.

Materials: this plan, contact list, EHR vendor name, cyber insurance policy summary, blank Incident Intake Form (Appendix B).

Inject 1 (0:00): "It is Monday morning at 7:45 AM. The front-desk member arrives, opens the workstation, and sees a full-screen ransom note. The desktop shows files with a .encrypted extension. Phones are working; EHR cloud login times out. Question: who is contacted, in what order, in the first 15 minutes?"

Discuss and document the answer. Compare to the plan's contact list.

Inject 2 (0:10): "The Security Officer arrives at 8:15 AM. Two more workstations are showing the same ransom note. The clinical staff member's laptop is not affected. Patients begin arriving at 8:30 AM. Question: do you see patients today? How do you make that decision, and who makes it?"

Discuss containment vs. operations. Document.

Inject 3 (0:20): "By 9:30 AM forensic triage confirms 12 workstations and the on-site file server are encrypted. Cloud EHR is restored from vendor backup but local document storage is encrypted. The Security Officer discovers an unfamiliar admin account was created 19 days ago. Question: is this a reportable breach? What is the discovery date for the 60-day clock?"

Discuss the breach risk assessment, the discovery date, the four- factor analysis. Document.

Inject 4 (0:30): "Cyber insurance has been notified. DFIR firm is engaged. The question now is patient notification. The forensic firm cannot yet confirm whether PHI was exfiltrated. Question: do you start drafting notification letters now, or wait for forensic confirmation?"

Discuss the documentation burden, the 60-day outer bound, state- level shorter bounds, and the OCR ransomware fact sheet's presumption.

After-action (0:35-0:45):

• Three things that worked.
• Three things that did not work.
• Three remediation items with assigned owner and due date.

File the after-action report in the binder under Incident Response — Tabletop Exercises. ```

State preemption carve-outs

When state breach-notification law is stricter than HIPAA, the stricter law controls under 45 CFR § 160.203. The four high-volume overlays:

| State | Statute | Notable difference vs. HIPAA | | --- | --- | --- | | California | Civ. Code § 1798.82; CMIA Civ. Code § 56.36 | "Most expedient time possible" with attorney-general notice for 500+; CMIA adds 15-business-day patient access | | New York | SHIELD Act, Gen. Bus. Law § 899-bb | Information-security program required; broader definition of personal information | | Texas | Tex. Bus. & Com. Code § 521.053 | Notification "as quickly as possible"; AG notice for 250+ within 30 days | | Florida | F.S. § 501.171 (FIPA) | Notice to affected individuals and AG within 30 days |

The practice's incident response plan should name which state authorities apply to its patient panel and pre-load the notification contacts.

How to deploy

Paste the template into the binder; fill in the contact list; pre-sign a DFIR or carrier-panel retainer so engagement is not the bottleneck during a real incident; run one tabletop in the next 60 days; file the after-action report; add the tabletop date to the annual review calendar.

The single highest-leverage deployment move is the pre-vetted DFIR contact. Practices that find a forensic firm at the moment of an incident lose three to seven days to onboarding before containment can begin. Practices with a current retainer engage in hours.

Common gaps

What we see fail in practice:

1. No documented test. The plan exists; the tabletop has never been run; OCR asks for evidence of testing and there is none.
2. Stale contact list. The Security Officer named in the plan left two years ago; the cyber insurance policy lapsed; the EHR vendor's incident phone number is wrong.
3. Workforce members power off devices on discovery. Memory state is lost; forensic scope shrinks; the breach risk assessment becomes harder to defend.
4. Insurance carrier notified late. Most cyber policies require notification within 24-72 hours; late notice voids coverage.
5. No log of small incidents. Lost laptops, mis-faxed records, accidental email disclosures — all are security incidents under § 164.304 and need to be logged even when they are not breaches.

Maintenance cadence

Annual tabletop exercise with after-action report. Quarterly contact-list verification. Annual review of the plan against the current version of NIST SP 800-61 Rev. 3 and the most recent OCR guidance. Six-year retention of every incident record, every after-action report, and the plan itself per § 164.316(b)(2)(i).

A plan with a current contact list, a documented annual tabletop, and an incident log is the version that holds up to an OCR data request after a real breach.

How d3rx fits

The d3rx compliance binder generates the incident response plan, the tabletop script, the Incident Intake Form, the after-action template, the breach decision matrix, and the state preemption table, with citations to § 164.308(a)(6), § 164.402, NIST SP 800-61 Rev. 3, and state breach-notification statutes inline. The practice's Security Officer remains responsible for testing, executing, and updating the plan.