Skip to content
All tabletop exercises
Third party·Starter·Executive audience

A billing vendor's breach starts your HIPAA notification clock

The prompt — read this to the room

Your medical billing company, a business associate that processes claims for your 180-physician practice, sends a two-paragraph email: an unauthorised party accessed one of their file servers 'between March and June' and some of your patients may be affected. They found it 41 days ago. They have not said which patients, what data, or whether it was encrypted. Your compliance officer asks when your own 60-day clock started, and whether it started without you. Patients are calling the front desk after a local news story. What do you need from the vendor today, and who owns the answer?

Total duration
1 h 15 min
People to involve
6
Best fit
Healthcare

Who to involve

Most important first.

  • Privacy officer / DPO
  • Legal counsel
  • CISO / Head of security
  • Vendor / procurement manager
  • Communications / PR
  • Customer support

What it tests

  • Work out the practice's discovery date with counsel, using the business associate agreement
  • Get the specific facts the four-factor breach risk assessment needs from the vendor
  • Agree who notifies patients, HHS and media, and who pays for it
  • Give front-desk and call-centre staff an accurate script the same day

Outline of activities

  1. 1The vendor's email and what is missing from it
  2. 2Discovery date and the 60-day clock
  3. 3Information request and the business associate agreement
  4. 4Who notifies whom: patients, HHS, media, states
  5. 5Front-desk script and the next 72 hours

Run sheet (Pro)

The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.

Loading…

More third party exercises

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
A billing vendor's breach starts your HIPAA notification clock — Tabletop Exercise · PlayCISO