Breach notification policy, four-factor worksheet and notice letters

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.400–164.414 (Breach Notification Rule); Minn. Stat. 325E.61 (Minnesota data breach notice).

Approved by Dr. Maria Lindqvist, Owner. Breach assessor: Janelle Okafor with counsel. HHS breach portal and under-500 annual report: Janelle Okafor. Responsible officer: Janelle Okafor, Office Manager.

Purpose

When PHI is lost, stolen, sent to the wrong person or seen by someone who should not see it, Granite City Family Dental must decide within days whether the event is a reportable breach, and if so notify patients, HHS and sometimes the media and the State within fixed deadlines. This policy gives the definitions, the worksheet, the deadlines and the letters. Late or missing notification is itself a violation, and OCR expects to see the written assessment even for events the practice decided were not breaches.

1. Definitions

• Breach: the acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule which compromises the security or privacy of the PHI (45 CFR 164.402). Every impermissible use or disclosure is presumed to be a breach unless the four-factor assessment shows a low probability that the PHI has been compromised.
• Three exceptions that are not breaches: (1) unintentional acquisition, access or use by a workforce member acting in good faith within their authority, with no further use or disclosure; (2) inadvertent disclosure from one authorized person to another at the practice, with no further use or disclosure; (3) a disclosure where the practice has a good-faith belief the recipient could not reasonably have retained the information (for example, a misdirected mailing returned unopened).
• Unsecured PHI: PHI that is not rendered unusable, unreadable or indecipherable to unauthorized persons through encryption or destruction consistent with HHS guidance. Encryption safe harbor: a lost or stolen laptop, phone, drive or backup that was encrypted to the HHS standard (for example BitLocker, FileVault or device encryption with the key not compromised) is not a breach of unsecured PHI and no notification is required; the practice still logs the event and keeps the proof of encryption. Paper and media properly shredded or purged (NIST 800-88) are likewise secured.
• Discovery: a breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to any workforce member or agent of the practice other than the person who committed it (45 CFR 164.404(a)(2)). The 60-day clock starts that day, not the day the investigation ends.

2. Assessment procedure

1. Every incident involving PHI is reported under document 16 and handed to Janelle Okafor with counsel the day it is contained.
2. The assessor first checks whether one of the three exceptions applies or the encryption safe harbor applies. If so, that is written on the worksheet and the event is closed as "Not a breach (documented)".
3. Otherwise the assessor completes the four-factor worksheet below within five business days. Counsel is consulted for any event involving more than a handful of patients, Social Security numbers, financial information, a cyber-attack, or a business associate.
4. The conclusion is recorded in the incident log (document 16) with the date and the assessor's name, and the worksheet is filed behind this policy for six years.
5. If notification is required, the Privacy Officer starts the letters at once; waiting until the end of the 60 days is an unreasonable delay unless the investigation genuinely needs the time.

3. Who is notified and by when

Law-enforcement delay (164.412). If a law-enforcement official states that notification would impede a criminal investigation or damage national security, the practice delays for the period stated in writing, or for no more than 30 days if the statement is oral (the official's name and the date are written down). The delay does not restart the clock afterward.

Burden of proof (164.414). The practice must be able to show either that every required notification was made or that the event was not a breach. The worksheet, the incident log entry, copies of letters, the portal confirmation and the mailing list are the proof and are kept for six years.

4. Content of the individual notice

Written in plain language and containing, as far as known (45 CFR 164.404(c)):

1. a brief description of what happened, including the date of the breach and the date of discovery;
2. the types of unsecured PHI involved (such as name, date of birth, Social Security number, diagnosis, insurance information);
3. steps the individual should take to protect themselves;
4. what the practice is doing to investigate, to mitigate harm and to protect against further breaches;
5. how to contact the practice: a toll-free number or the main line, an email address, a website or a postal address.

The letter template in this document contains each element. For large breaches the practice arranges a toll-free number through the cyber insurer or a notification vendor.

5. Minnesota overlay

Minnesota's data breach law (Minn. Stat. 325E.61) applies to Granite City Family Dental in addition to HIPAA; there is no HIPAA exemption in the Minnesota statute (its only exemption is for certain financial institutions). It is triggered when a Minnesota resident's first name or initial and last name are exposed together with a Social Security number, a driver's license or Minnesota identification card number, or a financial account or card number with any required code, where the data was not encrypted or the key was also taken.

• Notice to the affected residents goes out in the most expedient time possible and without unreasonable delay; the practice uses the HIPAA letter, which satisfies both laws when sent promptly.
• When more than 500 persons are notified at one time, all nationwide consumer reporting agencies (Equifax, Experian, TransUnion) are told within 48 hours of the notice.
• Substitute notice under Minnesota law is permitted only when notice would cost more than $250,000, more than 500,000 people are affected, or the practice lacks contact information, and consists of email, website posting and statewide media.
• A business associate or vendor that maintains the practice's data must tell the practice immediately on discovery.

Acknowledgment that the practice understands this separate law: Yes.

6. After notification

• Mitigation: the practice offers credit monitoring when Social Security or financial numbers were exposed, corrects the cause, and retrains or sanctions as needed (45 CFR 164.530(f)).
• The incident is reviewed at the next annual meeting and the lessons go into the risk register.
• OCR may open an investigation after any portal entry; the binder, the worksheet and the risk analysis are what it will ask for first.

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________

Four-factor breach risk assessment worksheet

Granite City Family Dental — 45 CFR 164.402. Completed by Janelle Okafor with counsel within five business days of containment. One worksheet per incident; file behind the policy and summarize in the incident log.

Incident log reference / date: ______________ Date of discovery (clock start): ______________ 60-day deadline: ______________

Description of the impermissible use or disclosure:

__________________________________________________________________________

__________________________________________________________________________

Step 1 — Exceptions and safe harbor (if any box is checked, explain and stop; the event is not a breach):

☐ Unintentional good-faith access by a workforce member within authority, no further use or disclosure.

☐ Inadvertent disclosure between authorized persons at the practice, no further use or disclosure.

☐ Good-faith belief the recipient could not reasonably have retained the information.

☐ The PHI was encrypted or destroyed to the HHS standard (attach proof: encryption report, destruction certificate).

Explanation: __________________________________________________________________________

Step 2 — Four factors:

Factor 1. Nature and extent of the PHI, including the types of identifiers and the likelihood of re-identification. What information was involved (names, dates of birth, Social Security numbers, diagnoses, medications, insurance, financial)? How many patients? Could the person identify them?

__________________________________________________________________________

__________________________________________________________________________

Factor 2. The unauthorized person who used the PHI or to whom it was disclosed. Another covered entity or a person bound by HIPAA? A stranger? A known individual who signed an attestation of destruction?

__________________________________________________________________________

Factor 3. Whether the PHI was actually acquired or viewed. Evidence that it was opened, read, copied, or that it was not (forensic report, returned unopened, device recovered with logs).

__________________________________________________________________________

Factor 4. The extent to which the risk has been mitigated. Recall, return, written assurances of destruction, remote wipe, password reset, account closed.

__________________________________________________________________________

Step 3 — Conclusion:

☐ Low probability that the PHI has been compromised — not a reportable breach; document and close.

☐ Cannot show low probability — breach; notification required.

Number of individuals affected: ______ Residents by state: __________________________________________

Notifications required (check): [ ] Individuals [ ] Substitute notice [ ] Media (more than 500 in a state) [ ] HHS within 60 days (500 or more) [ ] HHS annual log by March 1 (fewer than 500) [ ] Consumer reporting agencies within 48 hours (Minnesota, more than 500) [ ] Other state law

Counsel consulted? [ ] Yes, name: ___________________________ [ ] No Insurer notified? [ ] Yes [ ] No

Assessor: Janelle Okafor with counsel Signature: ___________________________ Date: ______________

Privacy Officer review (Janelle Okafor): ___________________________ Date: ______________

Letter template 1 — Notice to the individual

Print on practice letterhead. Replace every blank. Send by first-class mail within 60 days of discovery.

Granite City Family Dental 412 2nd Street South, St. Cloud, MN 56301 320-555-0142

Date: ______________

Patient name: __________________________________________ Address: __________________________________________

Dear __________________________________________,

We are writing to tell you about an incident involving some of your health information held by Granite City Family Dental, what we are doing about it, and what you can do.

What happened. On or about ______________ (date of incident), __________________________________________ (plain description: for example, a laptop was stolen from a staff member's car; a letter intended for you was mailed to another patient; an email account was accessed by an unauthorized person). We discovered this on ______________ (date of discovery).

What information was involved. The information may have included your __________________________________________ (list only what applies: name, address, date of birth, dates of service, diagnosis or treatment information, medication list, health insurance information, Social Security number, financial account information). Your __________________________________________ was not involved.

What we are doing. We have __________________________________________ (for example: reported the matter to law enforcement; disabled the account and reset all passwords; retrieved the misdirected letter; encrypted all remaining devices; retrained our staff). We have reviewed our procedures to prevent this from happening again and have engaged our cyber-security insurer. We have reported this incident to the U.S. Department of Health and Human Services as the law requires.

What you can do. We recommend that you review the statements you receive from your health insurer and let them know of any service you did not receive. ______________ (If Social Security or financial numbers were involved: We are offering you ______ months of credit monitoring at no cost; to enroll, ______________. You may also place a free fraud alert or security freeze with the three credit bureaus: Equifax 1-800-685-1111, Experian 1-888-397-3742, TransUnion 1-800-916-8800, and you may obtain a free credit report at www.annualcreditreport.com.)

For more information. If you have questions, please contact Janelle Okafor, Office Manager, at 320-555-0142 or [email protected], or write to us at 412 2nd Street South, St. Cloud, MN 56301. ______________ (If a toll-free number was arranged: You may also call 1-800-___-____, Monday through Friday, ____ to ____.)

We take the privacy of your information seriously and we apologize for this incident.

Sincerely,

Dr. Maria Lindqvist Owner and Dentist, Granite City Family Dental

Letter template 2 — Substitute notice

Use when current contact information is missing for 10 or more affected individuals. Post conspicuously on the practice website home page (https://www.granitecityfamilydental.example) for 90 days, or publish in major print or broadcast media serving the area where the affected individuals live, and keep a toll-free number active for 90 days. Keep a dated copy or screenshot as proof.

NOTICE TO PATIENTS OF GRANITE CITY FAMILY DENTAL ABOUT A PRIVACY INCIDENT

Granite City Family Dental is notifying patients of an incident involving health information. On or about ______________, __________________________________________ (plain description). We discovered the incident on ______________.

The information involved may have included __________________________________________ (types of information). It did not include __________________________________________.

We have __________________________________________ (steps taken) and have reported the incident to the U.S. Department of Health and Human Services.

Patients who received care at Granite City Family Dental between ______________ and ______________ and have not received a letter from us may be affected. We recommend that patients review their insurance statements and report any service they did not receive. ______________ (Credit-monitoring and credit-bureau information if Social Security or financial numbers were involved.)

For more information, or to confirm whether your information was involved, call our toll-free line at 1-800-___-____ (available for 90 days from the date of this notice), contact Janelle Okafor at 320-555-0142 or [email protected], or write to Granite City Family Dental, 412 2nd Street South, St. Cloud, MN 56301.

Posted on: ______________ Removed on (not before 90 days): ______________ Posted by: ___________________________