All tabletop exercises
Data breach·Intermediate·Executive audience
Patient records from your clinic group appear on a leak site
The prompt — read this to the room
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
Total duration
1 h 30 min
People to involve
6
Best fit
Healthcare
Who to involve
Most important first.
- CEO / Managing director
- Legal counsel
- Privacy officer / DPO
- Communications / PR
- CISO / Head of security
- Customer support
What it tests
- Validate a data-theft claim quickly enough to make credible public statements
- Issue a holding statement that is accurate without confirming or denying what is not yet known
- Start the HIPAA breach risk assessment and fix the discovery date deliberately, with counsel
- Set a position on extortion contact with counsel, the insurer and law enforcement
Outline of activities
- 1The journalist's deadline and the sample file
- 2Is it ours? Validating the sample against source systems
- 3Holding statement and patient-facing script
- 4Extortion deadline, insurer and law enforcement
- 5Notification planning against the HIPAA timeline
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…