Start with the facts
Breach analysis begins with the information involved, who received or could access it, whether the risk was mitigated, and what the organization can document. Reporting duties and timelines depend on the applicable facts and legal requirements.
Preserve the decision record
Keep the incident facts, risk assessment, notifications, mitigation, and follow-up work together so the organization can explain what it decided and why.
References
- Breach Notification Rule HHS Office for Civil Rights