HIPAA Breach Log Template

HIPAA BREACH LOG AND INCIDENT TRACKING SYSTEM

INSTRUCTIONS FOR USE

This Breach Log Template is designed for HIPAA covered entities and business associates to document, track, and manage breaches of unsecured protected health information (PHI) as required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400-414). The log also supports documentation obligations under 45 C.F.R. § 164.530(j), which requires retention of all records related to HIPAA compliance for a minimum of six (6) years from the date of creation or the date the document was last in effect, whichever is later.

Privacy Officer or Designee: [________________________________]

Organization Name: [________________________________]

Organization Address: [________________________________]

Log Maintained Since: [__/__/____]

Key Definitions

Breach (45 C.F.R. § 164.402): The acquisition, access, use, or disclosure of protected health information in a manner not permitted under the HIPAA Privacy Rule that compromises the security or privacy of the protected health information. A breach is presumed unless the covered entity or business associate demonstrates through a documented risk assessment that there is a low probability the PHI has been compromised.

Security Incident (45 C.F.R. § 164.304): The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. Not all security incidents constitute breaches; however, all security incidents must be evaluated to determine whether a breach has occurred.

Unsecured PHI (45 C.F.R. § 164.402): Protected health information that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by HHS guidance (i.e., encryption meeting NIST standards or destruction per NIST SP 800-88).

Breach vs. Security Incident — Critical Distinction

SECTION 1: BREACH INCIDENT LOG ENTRIES

INCIDENT ENTRY NO. [____]

1.1 Incident Identification

1.2 Incident Classification

Type of Incident (check all that apply):

☐ Hacking/IT incident (ransomware, malware, phishing, network intrusion)
☐ Unauthorized access by workforce member
☐ Unauthorized access by third party
☐ Unauthorized disclosure — verbal
☐ Unauthorized disclosure — written/electronic
☐ Lost or stolen laptop/computer
☐ Lost or stolen portable electronic device (USB, phone, tablet)
☐ Lost or stolen paper records
☐ Mailing error (sent to wrong recipient)
☐ Fax error (sent to wrong number)
☐ Email error (sent to wrong recipient)
☐ Improper disposal of PHI (paper or electronic)
☐ Business associate breach
☐ EHR/system misconfiguration
☐ Patient portal access error
☐ Other: [________________________________]

1.3 Detailed Description of Incident

Narrative Description (what happened, how it was discovered, who was involved):

[________________________________]
[________________________________]
[________________________________]
[________________________________]
[________________________________]

1.4 PHI Types Involved

Check all categories of PHI involved in the incident:

☐ Patient name
☐ Date of birth
☐ Social Security number
☐ Address/geographic data
☐ Phone/fax number
☐ Email address
☐ Medical record number
☐ Health plan beneficiary number
☐ Account number
☐ Diagnosis/clinical information
☐ Treatment information
☐ Medications
☐ Lab results
☐ Mental health records
☐ Substance use disorder records (42 C.F.R. Part 2)
☐ HIV/AIDS status
☐ Genetic information (GINA)
☐ Sexual/reproductive health information
☐ Financial/billing information
☐ Insurance information
☐ Photographs/images
☐ Biometric identifiers
☐ Other: [________________________________]

1.5 Individuals Affected

1.6 Systems/Media Affected

☐ Electronic health record (EHR) system — Name: [________________________________]
☐ Email system
☐ Desktop computer(s) — Location: [________________________________]
☐ Laptop(s) — Asset ID: [________________________________]
☐ Server(s) — Name: [________________________________]
☐ Mobile device(s) — Type: [________________________________]
☐ Portable media (USB, external drive)
☐ Paper records
☐ Cloud-based system — Provider: [________________________________]
☐ Fax machine
☐ Copier/scanner
☐ Backup media
☐ Other: [________________________________]

Was the PHI encrypted at the time of the incident? ☐ Yes ☐ No
If yes, specify encryption standard: [________________________________]
Was the encryption key compromised? ☐ Yes ☐ No ☐ Unknown

SECTION 2: FOUR-FACTOR RISK ASSESSMENT

Per 45 C.F.R. § 164.402(2), a breach is presumed unless the covered entity or business associate demonstrates through a risk assessment that there is a low probability the PHI has been compromised. The following four factors must be assessed and documented:

Factor 1: Nature and Extent of the PHI Involved

Evaluate the types of identifiers and the likelihood of re-identification.

Risk Level for Factor 1: ☐ High ☐ Medium ☐ Low

Narrative Analysis: [________________________________]
[________________________________]

Factor 2: The Unauthorized Person Who Used or Received the PHI

Evaluate the identity and characteristics of the unauthorized recipient.

Risk Level for Factor 2: ☐ High ☐ Medium ☐ Low

Narrative Analysis: [________________________________]
[________________________________]

Factor 3: Whether the PHI Was Actually Acquired or Viewed

Evaluate whether the information was actually accessed or only potentially exposed.

Risk Level for Factor 3: ☐ High ☐ Medium ☐ Low

Narrative Analysis: [________________________________]
[________________________________]

Factor 4: Extent to Which Risk Has Been Mitigated

Evaluate steps taken to reduce the risk of harm.

Risk Level for Factor 4: ☐ High ☐ Medium ☐ Low

Narrative Analysis: [________________________________]
[________________________________]

Overall Risk Assessment Determination

Determination Made By: [________________________________]
Title: [________________________________]
Date of Determination: [__/__/____]

Note: If the covered entity is unable to demonstrate a low probability of compromise, the incident must be treated as a breach and notification obligations apply. The burden of proof rests with the covered entity or business associate (45 C.F.R. § 164.414(b)).

SECTION 3: CONTAINMENT AND REMEDIATION ACTIONS

3.1 Immediate Containment Actions

3.2 Root Cause Analysis

3.3 Corrective Actions / Remediation Plan

SECTION 4: NOTIFICATION STATUS TRACKING

4.1 Individual Notification (45 C.F.R. § 164.404)

Notification to affected individuals must be made without unreasonable delay and no later than 60 calendar days from the date of discovery of the breach.

Required Content of Individual Notification (45 C.F.R. § 164.404(c)):
☐ Brief description of what happened, including date of breach and date of discovery
☐ Description of types of unsecured PHI involved
☐ Steps individuals should take to protect themselves
☐ Brief description of what covered entity is doing to investigate, mitigate harm, and prevent future breaches
☐ Contact procedures (toll-free number, email, website, postal address)

4.2 HHS/OCR Notification (45 C.F.R. § 164.408)

4.3 Media Notification (45 C.F.R. § 164.406)

Required only when breach affects 500 or more individuals in a single state or jurisdiction.

4.4 State Attorney General / Regulatory Notification

Many states require separate breach notification to the state attorney general or other regulatory bodies, often with shorter timelines.

State-Specific Notification Deadlines (Selected):

• California (Cal. Civ. Code § 1798.82): Notification to AG if 500+ CA residents affected; "expedient" notification to individuals
• Texas (Tex. Bus. & Com. Code § 521.053): Notification within 60 days; AG notification if 250+ TX residents
• Florida (Fla. Stat. § 501.171): Notification within 30 days; AG notification if 500+ FL residents
• New York (N.Y. Gen. Bus. Law § 899-aa; SHIELD Act): Notification "in the most expedient time possible"; AG, DFS, and Division of State Police notification required

4.5 Business Associate Breach Reporting (45 C.F.R. § 164.410)

4.6 Law Enforcement Delay (45 C.F.R. § 164.412)

SECTION 5: ANNUAL BREACH SUMMARY REPORT

This section supports the annual compilation and review of all breach incidents. Complete at the end of each calendar year.

Reporting Period: [__/__/____] to [__/__/____]

Prepared By: [________________________________]

Date Prepared: [__/__/____]

5.1 Annual Summary Statistics

5.2 Breach Categories Summary

5.3 Trends and Patterns

Identified Trends: [________________________________]
[________________________________]

Repeat Incident Types: [________________________________]

Departments/Locations with Highest Incident Rates: [________________________________]

5.4 Corrective Action Effectiveness Review

5.5 Recommendations for Upcoming Year

[________________________________]
[________________________________]
[________________________________]

SECTION 6: SAMPLE LOG ENTRIES — REFERENCE EXAMPLES

The following examples illustrate how to document different breach types. These are for reference only and should not be submitted as actual incidents.

Example A: Hacking/Ransomware Incident

Example B: Unauthorized Access by Workforce Member

Example C: Mailing Error

Example D: Lost/Stolen Device

Example E: Verbal Disclosure

SECTION 7: OCR AUDIT PREPAREDNESS DOCUMENTATION

7.1 Documentation Retention Checklist

Per 45 C.F.R. § 164.530(j), the following documentation must be retained for a minimum of six (6) years:

☐ This breach log and all incident entries
☐ Risk assessment documentation for each incident
☐ Notification letters (copies)
☐ HHS breach portal submission confirmations
☐ Media notifications (copies)
☐ State AG notifications (copies)
☐ Business associate breach notifications received
☐ Law enforcement delay requests and correspondence
☐ Corrective action plans and completion documentation
☐ Root cause analysis documentation
☐ Sanctions applied to workforce members (if any)
☐ Training records related to breach incidents
☐ Policies and procedures related to breach notification
☐ Annual breach summary reports

7.2 Audit Response Preparation

SECTION 8: LOG MAINTENANCE INSTRUCTIONS

1. Assign Incident IDs sequentially using the format YYYY-NNN (e.g., 2026-001, 2026-002).

2. Record Entries Promptly. Begin a log entry as soon as an incident is reported. Update the entry as the investigation progresses. Under 45 C.F.R. § 164.404(a)(2), the date of discovery is the first day the breach is known or would have been known by exercising reasonable diligence.

3. Complete the Four-Factor Risk Assessment for every incident involving an impermissible use or disclosure of PHI. Document the assessment even if the determination is that the incident does not constitute a breach.

4. Track All Deadlines. The 60-day notification clock begins on the date of discovery, not the date of the breach itself. Calendar all notification deadlines immediately upon discovery.

5. Coordinate with Legal Counsel. Engage legal counsel early in the breach assessment process. Consider conducting the risk assessment under attorney-client privilege when appropriate.

6. Retain for Six Years Minimum. Per 45 C.F.R. § 164.530(j), all documentation must be retained for at least six years. Many states require longer retention. Establish a retention schedule that meets the most stringent applicable requirement.

7. Review Annually. Conduct an annual review of the breach log to identify trends, evaluate corrective action effectiveness, and update policies and procedures as necessary.

8. Secure the Log. This log contains sensitive information about security vulnerabilities and breaches. Store it securely with access limited to the Privacy Officer, Security Officer, legal counsel, and authorized compliance personnel.

9. Coordinate State Requirements. Many states have breach notification laws with shorter timelines or additional requirements. Consult the state-specific notification deadlines in Section 4.4 and review applicable state law for each incident.

10. Annual HHS Reporting. For breaches affecting fewer than 500 individuals, compile and submit the annual breach log to HHS within 60 days after the end of the calendar year in which the breaches were discovered (45 C.F.R. § 164.408(c)).

Sources and References

• U.S. Department of Health and Human Services, "Breach Notification Rule": https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• 45 C.F.R. Part 164, Subpart D — Notification in the Case of Breach of Unsecured PHI: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D
• HHS OCR, "How OCR Enforces the HIPAA Privacy & Security Rules": https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaa-privacy-and-security-rules/index.html
• 45 C.F.R. § 164.402 — Definitions (Breach, Unsecured PHI): https://www.law.cornell.edu/cfr/text/45/164.402
• 45 C.F.R. § 164.530 — Administrative Requirements (Documentation and Retention): https://www.law.cornell.edu/cfr/text/45/164.530
• HIPAA Journal, "HIPAA Breach Notification Requirements — Updated 2026": https://www.hipaajournal.com/hipaa-breach-notification-requirements/
• HHS OCR, "Fact Sheet: Ransomware and HIPAA": https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/ransomware-fact-sheet/index.html
• NIST SP 800-88, "Guidelines for Media Sanitization" (encryption/destruction guidance for rendering PHI unusable)