Privacy operations · incident triage · reviewed 28 August 2026
Privacy incident first-response record
A first-hours record for containment, fact preservation, advice, and deadline escalation.
Use the resource →Open immediately after suspected loss, misdelivery, unauthorized access, or another privacy or security event.
This does not decide whether an event is a reportable breach or supply required notice language.
Recheck the source links before relying on an older saved copy. Entries stay in this open page. Copy or print the working copy before leaving.
Working resource
Make the invisible facts visible.
Review point 01
Preserve the first report
Record when the event was discovered, by whom, and what was initially known without altering source evidence.
Review point 02
Contain without destroying evidence
Stop continuing exposure where possible and record each containment action.
Review point 03
Identify information and people
Document the types of information, systems, recipients, and potentially affected individuals.
Review point 04
Escalate to the right advisors
Record insurer, privacy, legal, vendor, and law-enforcement contacts as appropriate to the facts.
Review point 05
Calendar every possible deadline
Track federal, California, contract, payer, and vendor notice paths until applicability is resolved.
Review point 06
Document the determination
Preserve the analysis, mitigation, notices or basis for no notice, and corrective actions.
Private working copy
Carry the review into your own next action.
Your entries remain only in this open page. They are not saved, uploaded, transmitted, or placed in the URL. Use a non-identifying reference—not a client name.
Your working copy
Controlling material
Read the authority, not merely the worksheet.
Educational information only; not legal, clinical, tax, billing, or regulatory advice. A resource cannot resolve facts it was not given or authority that changed after the review date.
