Think You've Had a HIPAA Breach?

An email sent to the wrong person. A stolen laptop. A ransomware attack. I help Louisiana healthcare practices figure out what happened, whether it's a reportable breach, and what to do next.

Text me to talk

Text (504) 356-9678 and we'll set up a time to talk within one business day. The first conversation is free, and I don't ask for retainers. Breach deadlines start running when a problem is discovered, so reach out right away. Just send your name and a good time to reach you; please don't text any patient details.

Not every privacy incident is a reportable breach, and not every breach is as bad as it first looks. But the decisions you make in the first few days matter, and the clock starts running when the problem is discovered.

Common incidents

An email, fax, or text with patient information sent to the wrong person
A lost or stolen laptop, phone, or tablet
Ransomware or a hacked email account
An employee looking at records they had no reason to see
Records given to the wrong patient or family member
A breach at your EHR, billing, or other vendor

What to do right now

Contain it. Secure the device, change passwords, and try to retrieve misdirected information.
Don't delete anything. Keep emails, logs, and anything else that shows what happened.
Write down what happened and when you discovered it.
Don't send notices or tell patients anything yet. What you say, and when, matters.
Check your cyber insurance policy. Many require prompt notice of an incident.
Reach out to an attorney right away.

Is it a reportable breach?

Under HIPAA, an unauthorized use or disclosure of patient information is generally presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. That assessment, and your documentation of it, is often the most important part of the response.

If notification is required, HIPAA generally requires notifying affected patients without unreasonable delay and no later than 60 days after the breach is discovered, along with reporting to the federal government and, for larger breaches, the media. Louisiana has its own breach notification law with its own requirements.

How I help

Investigating what happened and what information was involved
Conducting and documenting the risk assessment, with a clear record of the decisions you made and why
Determining who must be notified, and when
Drafting notices to patients and required reports
Coordinating with your IT team, forensic investigators, and insurance carrier
Updating your policies and training afterward, so it doesn't happen again

Involving an attorney early can also help protect the confidentiality of your investigation.

Why practices work with me

I've practiced healthcare law for more than 17 years. After many years as in-house counsel and as COO of a healthcare agency with more than 200 employees, I understand how healthcare organizations handle patient information day to day and where the gaps usually are, so I can help you respond quickly, document your decisions carefully, and keep it from happening again.

No retainer. Payment plans that fit your budget.

I don't ask for retainers. I bill only for work I've completed, and you can set up a payment plan that fits your needs.

Don't guess. Get it right.

If you think your practice has had a breach, reach out before you decide anything. Consultations are available by phone, video, or in person across Louisiana.