Identification
Unique incident ID, reporter name, and contact to ensure traceability across systems and follow-up communications.
The report creates a single authoritative record that supports HIPAA breach assessment, internal risk mitigation, regulatory notifications, and accreditation reviews while aligning clinical follow-up with operational improvements.
Use this report to centralize facts, reduce duplication, and create a defensible timeline for internal and external reviewers.
Unique incident ID, reporter name, and contact to ensure traceability across systems and follow-up communications.
Precise date/time stamps for discovery, response actions, notifications, and containment steps to support forensic review.
List of patients, staff, systems or devices involved, including identifiers needed to assess exposure and notify individuals.
Clear factual narrative describing what happened, how it was discovered, and immediate consequences observed.
Containment steps, clinical interventions, IT remediation, and interim mitigation measures with responsible owners and deadlines.
Corrective actions, monitoring requirements, root-cause findings, and who will verify closure of remedial tasks.
| Field | Configuration |
|---|---|
| Reporter Field | Required; prefill from user directory |
| Reviewer Assignment | Conditional routing to compliance if PHI exposure flagged |
| Sign-off Field | Signature required from Clinical Lead and Compliance Officer |
| Evidence Upload | Allow multiple files; enforce allowed file types |
Ensure the selected platform meets privacy, retention, and access-control policies used by your organization and partners.
Notify supervisors and safety team within 1 hour of discovery.
Complete initial impact assessment within 24 hours.
Submit an internal preliminary report within 72 hours.
Finalize and approve the report within 7 days unless extended.
HIPAA breach notifications to affected individuals and OCR generally within 60 days of discovery.
Incident identified and initial facts collected.
Immediate steps taken to limit impact.
Cross-disciplinary impact and legal classification completed.
Affected parties and regulators notified as required.
The unit or service clinical lead certifies the clinical facts and confirms that patient care actions were taken and documented; their signature attributes clinical responsibility for the response.
The privacy or compliance officer confirms breach assessment conclusions, regulatory notification needs, and signs to attest the accuracy of classification and next steps.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day trial | Varies | Varies | Varies | Varies |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |