Incident response for a five-provider office should fit on two pages. If the plan only covers "ransomware on the EHR," you have ignored the channels that actually move patient packets every hour.
Cover these three events
- Email or attachment sent to the wrong recipient.
- Fax sent to the wrong number or left on a public tray.
- Form submission viewed by the wrong staff member or exported too widely.
Owners and evidence
Name a privacy lead and a backup. Write the vendor phone numbers on the plan. Practice pulling a message log, a fax confirmation, and a form audit row once a quarter. HIPAA Companion keeps those records in one stack so the drill is a login, not a scavenger hunt across three portals.
After any real event, write what happened, what you sent to the recipient, and whether you notified patients or HHS. Store that write-up with the log export.