Skip to main content
Important. If you think client information may have been exposed, tell the practice manager and Zack the same day. Within the hour if you can. You don’t need to be sure. You don’t need to know how bad it is. You just need to say something.

​
What counts as an incident

Anything where client information may have gone somewhere it shouldn’t. Examples:
  • An email or text sent to the wrong person
  • A lost or stolen phone, laptop, or paper
  • A client name or detail pasted into an AI tool, a personal app, or the wrong chat
  • Someone accessing a record without a work reason
  • A phishing email you clicked, or a login prompt you entered a password into
  • A screen visible to someone who shouldn’t see it
  • A vendor or system problem that exposed data
  • A client telling you they received someone else’s information
  • Anything that makes you think “that might be a problem”
If you’re wondering whether it counts, it counts. Report it.

​
How to report

  1. Tell the practice manager and Zack directly: call, text the practice channel, or email your practice account. Don’t put client details in the message; say “I need to report a possible privacy incident” and they’ll call you.
  2. Preserve what you can. Don’t delete the email, wipe the device, or clean up. The practice needs to see what happened.
  3. Write down what you know: what information, about whom (initials), who might have seen it, when, and how. Give it to the practice manager.

​
What happens next

The practice manager and Helen assess the incident, with Zack for anything technical. Under the HIPAA Breach Notification Rule, we determine whether it’s a reportable breach based on what was exposed, who saw it, whether they actually accessed it, and how well the risk was contained. Depending on the outcome, the practice may need to notify the affected client, the Department of Health and Human Services, and in large cases the media. Those notifications have legal deadlines, which is why the same-day reporting rule matters. You’ll be asked questions. Answer them fully. The practice will tell you what was decided.

​
What doesn’t happen

You won’t be punished for reporting an honest mistake. Mistakes are how breaches usually happen, and prompt reporting is what keeps them small. What we can’t work with is a problem we find out about late, or from a client, or from a regulator. Deliberately hiding an incident, or deliberately misusing client information, is a different matter and is grounds for immediate termination.

​
Clinical and safety incidents

Incidents involving client safety rather than privacy (a crisis, a threat, an injury in the office) have their own process. See Crisis and safety protocol and Workplace injuries and workers’ compensation. If an incident is both, report it both ways.

​
Who to contact