Question

A healthcare organization confirms that an attacker exfiltrated a database containing 12,000 patients' protected health information (PHI). The incident commander is finalizing the response and must ensure regulatory obligations are met. Under U.S. HIPAA Breach Notification Rule requirements, which action is the incident commander responsible for ensuring is completed?

Accepted Answer

Notify affected individuals and the HHS Secretary without unreasonable delay and no later than 60 days after discovery of the breach

Answer

Notify the affected individuals within 72 hours of discovering the breach, as required by all data protection laws

Answer

Delay all external notification until the eradication and recovery phases are fully complete to avoid disclosing incomplete information

Answer

Report the breach only to internal executive leadership, since regulatory bodies are notified solely during annual compliance audits