If Something Goes Wrong

The HIPAA Administrative Safeguards pair two standards that belong together here: §164.308(a)(6) security incident procedures (how you identify, respond to, and document an incident) and §164.308(a)(7) contingency plan (backups, disaster recovery, emergency-mode operation). Underneath both sits 45 CFR 164.400–414, the breach-notification rule — the legal reason any of this matters. The 60-day clock starts on the day you discover the incident, not the day the incident itself happened.

Two things make this chapter less scary than it sounds. First, having a plan on paper is worth a surprising amount — even a rough plan converts a crisis into a checklist and gets you credit for §164.308(a)(6)(ii) response-and-reporting. Second, most of the “what if” scenarios share the same foundation: a backup you trust, a written list of who to call, and the muscle memory of documenting what happened. Build those two foundations first, then we’ll walk through the specific scenarios.