Breach management & reporting records

Under the HIPAA Breach Notification Rule (45 CFR §§164.400–414), organizations must maintain detailed records covering the entire lifecycle of potential or confirmed breaches of unsecured Protected Health Information (PHI). These records serve as critical evidence during Office for Civil Rights (OCR) audits and investigations and play a key role in penalty determination and defense. Covered entities and business associates are required to retain breach-related records for at least six years. These records demonstrate timely incident detection, risk assessment, notification decisions, and remediation actions. Breach documentation also ties directly to incident response planning, internal audits, and enterprise risk management activities discussed earlier. Centralized storage, often through compliance platforms, helps organizations respond quickly to regulatory requests and reduces exposure to higher-tier penalties. Incident detection and initial records Breach documentation begins as soon as a security incident is discovered. Organizations should log all incidents, even before determining whether they rise to the level of a reportable breach. Initial records typically capture:

• Date and time the incident was detected
• Systems, applications, and types of PHI involved
• Estimated number of individuals affected
• How the incident was discovered (for example, user report or automated alert)
• Immediate containment actions, such as system isolation or credential resets

These early entries often also document activation of the incident response team, preservation of logs and emails, and chain-of-custody for any forensic evidence. This documentation establishes a clear timeline and supports defensibility by showing prompt action. The incident log also marks the start of the 60-day notification clock, pending the outcome of the breach risk assessment. Risk assessment documentation HIPAA requires organizations to perform and document a breach risk assessment for each incident involving PHI. These assessments evaluate four required factors:

• The nature and extent of the PHI involved
• The unauthorized person who accessed or received the information
• Whether the PHI was actually acquired or viewed
• The extent to which the risk was mitigated

Risk assessment records commonly include worksheets or scoring matrices, supporting evidence such as system logs or scan results, and written conclusions explaining the determination. Assumptions, expert input, and justifications—such as concluding a low probability of compromise due to strong encryption—should be clearly documented and signed by qualified personnel. Importantly, both negative and positive determinations must be retained. Incidents determined not to be breaches still require documentation, while confirmed breaches move forward to notification and remediation. Notification and reporting evidence When notification is required, organizations must retain proof that all HIPAA notification obligations were met. Notification records typically include:

• Copies of individual notices sent by mail or approved electronic means within 60 days
• Proof of delivery, such as mailing logs or email receipts
• Templates showing required content, including breach description, data types involved, mitigation steps, and contact information

For reporting to HHS:

• Breaches affecting more than 500 individuals require submission through the HHS portal within 60 days of discovery
• Breaches affecting fewer than 500 individuals are reported annually in an aggregated submission, due by March 1 of the following year

If a breach affects more than 500 residents of a state or jurisdiction, records of media notifications—such as press releases or website postings—must also be retained. Business associates must document timely notifications to covered entities, in accordance with Business Associate Agreement (BAA) requirements. Post-notification and remediation records After notifications are completed, organizations are expected to document how the incident was addressed and prevented from recurring. Post-incident records often include:

• Root-cause analysis findings
• Updates to risk management plans and controls
• Evidence of workforce retraining or sanctions, where applicable
• Verification that corrective actions were effective, such as follow-up scans or access reviews

These materials are typically consolidated into a breach record file with references said to related training, audit findings, or corrective action plans. Periodic review of breach logs helps identify trends—such as recurring phishing incidents—and informs broader program improvements. All breach management records should be version-controlled, retained for six years, and readily accessible to support OCR inquiries, corrective action plans, and long-term compliance maintenance.