Incident Response Plan
The documented plan describing how a covered entity detects, contains, eradicates, and recovers from a security incident.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Primary sources
- 3
- Workspace handoff
- compliance binder →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
45 CFR 164.308(a)(6) requires policies and procedures to identify and respond to suspected or known security incidents. NIST SP 800-66 Rev. 2 recommends mapping the plan to the NIST SP 800-61 incident-handling lifecycle.
How it shows up in your practice
Ransomware, phishing-driven account takeover, and lost devices are the three scenarios most plans must address. Tabletop the plan at least annually and after major workforce or system changes.
Sources
- 45 CFR 164.308 — Administrative safeguardshttps://www.ecfr.gov/current/title-45/section-164.308
- HHS — HIPAA Security Rulehttps://www.hhs.gov/hipaa/for-professionals/security/index.html
- NIST SP 800-66 Rev. 2 — HIPAA Security Rule Implementation Guidehttps://csrc.nist.gov/pubs/sp/800/66/r2/final
Use the incident response playbook in the Compliance Binder
Open compliance binder →Related terms
- HIPAA & PrivacyHIPAA Breach Notification RuleThe federal rule at 45 CFR Part 164 Subpart D requiring covered entities and business associates to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI.
- SecurityRansomwareMalicious software that encrypts data or systems and demands payment for decryption; HHS guidance generally presumes a ransomware event on ePHI is a HIPAA breach.
- SecurityPhishingSocial-engineering attack that uses deceptive email, text, or voice messages to trick recipients into revealing credentials or installing malware.
- SecurityContingency PlanThe HIPAA-required plan covering data backup, disaster recovery, and emergency-mode operation when normal operations are disrupted.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryContingency PlanThe HIPAA-required plan covering data backup, disaster recovery, and emergency-mode operation when normal operations are disrupted.
- GlossaryPhishingSocial-engineering attack that uses deceptive email, text, or voice messages to trick recipients into revealing credentials or installing malware.
- GlossaryRansomwareMalicious software that encrypts data or systems and demands payment for decryption; HHS guidance generally presumes a ransomware event on ePHI is a HIPAA breach.
- GlossaryHIPAA Breach Notification RuleThe federal rule at 45 CFR Part 164 Subpart D requiring covered entities and business associates to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI.
- ComplianceHealthcare Incident Response Plan — Template + Tabletop ExerciseA 2026 healthcare incident response plan template aligned to 45 CFR 164.308(a)(6) and NIST SP 800-61 Rev. 3, with a tabletop exercise script for small practices.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- SRAHIPAA Contingency Plan for a Small PracticeWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.