Templates › Inspections › SEO page

Run: HIPAA Breach Risk Assessment

Use this HIPAA Breach Risk Assessment template to document the four-factor analysis for a suspected PHI incident and decide whether breach notification is re...

Fill this out, get a PDF emailed to you. No sign-up required. Want to run it with your team and track results? Sign up free →

Incident Overview

Incident date and time recorded critical (required)

Document when the unauthorized use or disclosure occurred or was discovered.

Note (optional)

Incident type identified critical (required)

Classify the event as unauthorized use, unauthorized disclosure, loss, theft, misdirected communication, improper access, or other.

PHI involved confirmed critical (required)

Confirm whether the incident involved protected health information.

Yes No N/A

Incident summary documented

Provide a concise factual summary of what happened, including systems, documents, or communications involved.

Discovery source identified

Identify how the incident was discovered.

Incident report reference number

Enter the internal case, ticket, or incident reference number.

Factor 1: Nature and Extent of PHI

PHI identifiers included critical (required)

Select the types of identifiers present in the disclosed or accessed information.

Minimum necessary standard applied

Determine whether the PHI involved was limited to the minimum necessary information for the intended purpose.

Yes No N/A

Sensitivity of PHI assessed critical (required)

Rate the sensitivity and potential harm associated with the PHI involved.

Note (optional)

Volume of PHI involved

Enter the approximate number of records, files, or data subjects affected.

Likelihood of re-identification evaluated critical (required)

Assess whether the information could reasonably be used to identify the individual if not fully de-identified.

Yes No N/A

PHI was encrypted or otherwise secured

Indicate whether the PHI was secured using an approved encryption or equivalent protection method at the time of the incident.

Yes No N/A

Factor 2: Unauthorized Person

Recipient identity determined critical (required)

Identify the unauthorized person or entity that received or accessed the PHI.

Recipient had authorization to receive PHI critical (required)

Confirm whether the recipient was authorized under policy, contract, or role to receive the PHI.

Yes No N/A

Recipient relationship to covered entity assessed

Describe the recipient's role, contractual relationship, or other relevant connection to the covered entity or business associate.

Recipient confidentiality obligations confirmed

Determine whether the recipient is bound by confidentiality obligations, privacy agreements, or legal restrictions.

Yes No N/A

Potential for further disclosure assessed

Rate the likelihood that the recipient could further use or disclose the PHI inappropriately.

Note (optional)

Factor 3: Actual Acquisition or Viewing

Evidence of access reviewed critical (required)

Review logs, email tracking, access records, or other evidence to determine whether the PHI was accessed.

Yes No N/A

Actual viewing confirmed critical (required)

Confirm whether the PHI was actually viewed or acquired by the unauthorized person.

Yes No N/A

Evidence source documented

Select the evidence used to support the determination.

Note (optional)

Time to containment documented

Enter the approximate number of hours from discovery to containment or access restriction.

Access successfully terminated or restricted

Confirm whether access was terminated, revoked, or otherwise restricted after discovery.

Yes No N/A

Factor 4: Mitigation and Notification Determination

Mitigation steps completed critical (required)

Select all mitigation actions taken to reduce the risk of compromise.

Note (optional)

Residual risk after mitigation assessed critical (required)

Rate the remaining risk after mitigation actions were completed.

Note (optional)

Breach notification required determination critical (required)

Document the final determination based on the four-factor assessment.

Note (optional)

Notification deadline calculated

If notification is required, record the deadline for required notifications.

Corrective action plan initiated

Confirm whether a corrective action plan, policy update, or retraining plan has been initiated.

Yes No N/A

Review, Approval, and References

Privacy officer or compliance reviewer approval critical (required)

Signature of the privacy officer, compliance officer, or designated reviewer approving the assessment.

Legal counsel consulted

Indicate whether legal counsel was consulted for the final determination.

Yes No N/A

Reference document

Record the applicable HIPAA breach risk assessment policy, incident response SOP, or legal memo reference.

Get your results

Enter your email — we'll send you a PDF of your filled-out template. We won't sign you up to anything; you can opt in to the trial from the email if you want.

Email (required)

Your name (optional)

Generated with MangoApps Templates — browse 240+ free