If Something Goes Wrong

Two HIPAA rules sit behind this chapter, and they go together. One is about handling an incident — how you’d notice it, what you’d do, and writing down what happened (§164.308(a)(6), security incident procedures). The other is about getting back on your feet — backups, recovery, and keeping care going in an emergency (§164.308(a)(7), contingency plan). Underneath both is the breach-notification rule (45 CFR 164.400–414) — the legal reason any of this matters. Its clock gives you 60 days, and it starts the day you discover the problem, not the day it happened.

Two things make this chapter less scary than it sounds. First, having a plan on paper is worth a surprising amount — even a rough plan converts a crisis into a checklist and gets you credit for §164.308(a)(6)(ii) response-and-reporting. Second, most of the “what if” scenarios share the same foundation: a backup you trust, a written list of who to call, and the muscle memory of documenting what happened. Build those two foundations first, then we’ll walk through the specific scenarios.