HIM 530 Module 7 Final Project Milestone Three Example

Final Project Milestone Three: When Prevention Fails, an Incident Response and Breach Notification Plan for Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Final Project Milestone Three

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone Three: When Prevention Fails, an Incident Response and Breach Notification Plan for Osprey Point Health

Milestone Two lowered Osprey Point Health's highest risks, but no set of controls prevents every incident. What matters then is how quickly the medical center detects the problem, limits the damage, keeps caring for patients and meets its legal duties. Osprey Point's existing plan, written in 2020, lists phone numbers but has never been tested. This milestone replaces it with a plan built around roles, severity, clear steps, communication and breach notification, and tests it with a tabletop exercise.

The Response Team

The incident response team has a core group and an extended group. The core group includes the information security officer as incident commander, the privacy officer, the chief information officer, the health information director and a clinical operations leader. The extended group joins as needed: legal counsel, communications, human resources, facilities, the cyber insurance carrier's breach coach and outside forensic investigators on retainer. Each role has a named primary and backup, since incidents do not wait for business hours. Contact details for every role are kept in a printed binder and on a phone app that works when hospital systems are down, since a plan stored only on the network is useless during ransomware. The binder is checked and reprinted every quarter.

Severity Levels

Table 1 defines four severity levels, which determine who is called and how fast.

Table 1. Incident Severity Levels

Note. Levels defined by the author with the security committee.

Steps From Detection to Review

NIST's 2025 incident response guidance places response within the broader Cybersecurity Framework, treating preparation, detection, response and recovery as parts of continuous risk management rather than a separate emergency activity (Nelson et al., 2025). Osprey Point's plan follows that structure. Detection and analysis confirm whether an event is an incident and assign severity. Containment limits spread, for example by isolating infected systems or disabling a compromised account, while preserving evidence. Eradication removes the cause, and recovery restores systems from verified clean backups, starting with those that support patient care. Within a month of closing an incident, a review records successes, failures and needed changes, and its actions feed back into the risk register.

Keeping Care Going

A critical incident is a clinical event. When the record system is unavailable, units switch to downtime procedures: printed downtime reports of current patients and medications, paper documentation and manual ordering and results processes. If the emergency department cannot work safely, it can ask regional dispatch to send ambulances elsewhere. In the attack studied by Dameff et al. (2023), a single system's ransomware outage pushed up volumes, waits and ambulance arrivals at neighboring emergency departments, so the plan includes notifying regional hospitals and the emergency medical services coordinator early in any Level 4 incident. The health information department will manage the return of downtime paper records to the electronic record after recovery.

Who Is Told What, and When

Communication follows the severity level. For a Level 3 or 4 incident, the incident commander informs the chief executive officer within one hour, the board chair the same day and staff through clear, regular updates that tell them what to do. The cyber insurer must be notified promptly under the policy, and law enforcement, usually the FBI for ransomware, is contacted early. Communications staff prepare holding statements for media and patients, reviewed by legal counsel, and a single spokesperson speaks for the hospital.

Breach Assessment and Notification

Any incident involving patient data triggers a breach risk assessment. Under HIPAA, an improper use or disclosure counts as a breach unless a documented review of four factors shows compromise to be unlikely. The review weighs the type and volume of data exposed, who obtained or used it, whether anyone actually saw or took it and what has been done to reduce the harm. The kind of data matters: Jiang and Bai (2020) found that many breaches exposed identifiers that enable financial fraud, which raises the harm to patients. When notice is required, patients must hear from Osprey Point promptly and never later than 60 days after the breach came to light; notify federal regulators within 60 days if 500 or more people are affected, or in an annual log if fewer; notify prominent media if more than 500 residents of a state are affected; and meet North Carolina's breach law, which also requires notice to the state attorney general's office.

Testing the Plan

The plan was tested in a three-hour tabletop exercise simulating ransomware that encrypts the record system on a Friday night. Three gaps emerged: the downtime reports had not printed since a system upgrade, no one knew how to reach the forensic firm after hours and communications staff lacked approved templates for patients. Each became an action item with an owner and date. Choi et al. (2019) found that security changes made after hospital breaches were associated with slower delivery of urgent cardiac care, a reminder that recovery plans should be tested with clinicians so that new safeguards do not create new harm.

Conclusion

Osprey Point's new plan assigns roles with backups, grades incidents by severity, follows current NIST guidance from detection through review, keeps care going and meets every notice deadline. A tabletop exercise already found three gaps that would have hurt in a real attack. The plan will be exercised twice a year and reviewed after every Level 3 or 4 incident, and it becomes part of the full information protection program in the final project. Each exercise will rotate the scenario, from an insider case to a vendor breach, so the team practices more than one kind of bad day.

References

Choi, S. J., Johnson, M. E., & Lehmann, C. U. (2019). Data breach remediation efforts and their implications for hospital quality. Health Services Research, 54(5), 971-980. https://doi.org/10.1111/1475-6773.13203

Dameff, C., Tully, J., Chan, T. C., Castillo, E. M., Savage, S., Maysent, P., Hemmen, T. M., Clay, B. J., & Longhurst, C. A. (2023). Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Network Open, 6(5), Article e2312270. https://doi.org/10.1001/jamanetworkopen.2023.12270

Jiang, J. X., & Bai, G. (2020). Types of information compromised in breaches of protected health information. Annals of Internal Medicine, 172(2), 159-160. https://doi.org/10.7326/M19-1759

Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61, Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3