Responding to a HIPAA Request, Breach, or Complaint: A Practical Checklist

Healthcare > Health Information Privacy and HIPAA | Published 26 November 2023 - Updated 2 July 2026 | UpLaw - uplaw.us

How to Use This Checklist

Patients start at Part 1. Entities receiving a request start at Part 2. If something has happened, go to Part 5 today and record the discovery date first. Doctrine is in the comprehensive guide; the orientation piece is who is allowed to read your chart; the forms are in the toolkit.

⚠️ The breach clock starts at discovery, not at the end of the investigation. Sixty days for individual notice under 42 U.S.C. § 17932 — and your state deadline may be shorter.

Part 1 — Requesting Your Own Records

☐ Put it in writing and call it a request under the HIPAA right of access.

☐ Name the format — electronic, in a specified file type if readily producible.

☐ Say where to send it, including to a third party if you choose.

☐ Specify the date range and the record set you want, or ask for the complete record.

☐ Note the thirty-day deadline and ask for written confirmation of the receipt date.

☐ Note that search and retrieval time may not be charged and that access is not conditioned on paying an unrelated balance.

☐ Ask for an accounting of disclosures if you are concerned about who has seen the record.

☐ Ask for confidential communications — a specific phone number or address — if that matters to your safety.

☐ If you paid out of pocket in full for a service, you may require the provider not to disclose it to your health plan.

☐ If you are denied, ask for the denial in writing with the basis, and ask whether it is reviewable.

☐ If you get no response in thirty days, send a follow-up citing the deadline, then file a complaint with the Office for Civil Rights within 180 days.

Part 2 — Receiving an Access Request

☐ Determine who is asking. The individual (access right), a personal representative (treated as the individual), or a third party with an authorization. The rules differ.

☐ Log the receipt date. The thirty-day clock runs from it.

☐ Verify identity using a reasonable method; do not impose barriers that function as denials.

☐ Identify the designated record set and pull everything within it, including information held by business associates.

☐ Produce in the requested format if readily producible; otherwise produce in a readable electronic form the individual agrees to.

☐ Send to a third party where the individual directs it in writing.

☐ Calculate the fee correctly: labor for copying, supplies, postage, and any agreed summary. No search and retrieval time.

☐ Do not condition access on payment of an unrelated bill or on a stated reason.

☐ Use the extension properly if needed: one 30-day extension, written notice, reason, and expected date.

☐ Document any denial with the ground, and provide the review process for reviewable grounds.

☐ Consider the information blocking rules at 45 C.F.R. part 171 before withholding anything.

Part 3 — Receiving a Third-Party Authorization

☐ Check the core elements: description of the information, who discloses, who receives, purpose, expiration, signature and date, revocation statement, conditioning statement, and redisclosure statement.

☐ Confirm it has not expired or been revoked.

☐ Confirm it is not a compound authorization where prohibited.

☐ Disclose only what the authorization covers — not the entire chart by default.

☐ Check for special categories requiring separate consent: psychotherapy notes, 42 C.F.R. part 2 records, HIV, genetic, and state-protected information.

☐ Log the disclosure for accounting purposes where required.

☐ Do not treat an individual's access request as a third-party authorization request. The fee limits and deadlines are different and better for the individual.

Part 4 — Subpoenas, Court Orders, and Law Enforcement

☐ Identify what it actually is: a court order, a subpoena, an administrative demand, a discovery request, or an informal request.

☐ A court order compelling disclosure permits release of what the order authorizes, and no more.

☐ A subpoena without a court order requires satisfactory assurances — reasonable efforts to notify the individual with an opportunity to object, or reasonable efforts to obtain a qualified protective order.

☐ Verify the assurances in writing before producing anything.

☐ Check for special categories. 42 C.F.R. part 2 records require a court order meeting specific criteria; state law protects mental health, HIV, genetic, and reproductive health information more strictly.

☐ Apply the minimum necessary standard even where disclosure is permitted.

☐ For law enforcement, confirm the request falls within one of the six enumerated circumstances and observe the limits on each.

☐ Decline informal requests and escalate them.

☐ Document the basis for every disclosure and log it for accounting where required.

☐ Notify counsel for anything unusual, and see the discovery resources.

Part 5 — The First Twenty-Four Hours of an Incident

☐ Record the date and time of discovery. Everything runs from it.

☐ Contain: disable the account, isolate the system, revoke access, recall the message, retrieve the device.

☐ Preserve evidence. Do not wipe, reimage, or delete. Capture logs before they rotate.

☐ Assemble the team: privacy officer, security officer, counsel, IT, communications.

☐ Decide the privilege posture in writing — is the investigation directed by counsel?

☐ Notify the cyber insurer. Most policies require panel vendors and treat late notice as a coverage defense. See the tender checklist.

☐ If a business associate reported it, confirm what they know, what they have done, and what they will provide.

☐ Do not notify anyone externally yet except the insurer, counsel, and law enforcement if warranted.

☐ Open an incident file and log every action with a timestamp.

Part 6 — Assessing Whether It Is a Breach

☐ Determine whether the use or disclosure was permitted. If permitted, it is not a breach.

☐ Check the three exceptions: unintentional good-faith acquisition by a workforce member; inadvertent disclosure between authorized persons at the same entity; and a good-faith belief the recipient could not reasonably have retained the information.

☐ Check encryption. Information encrypted to the specified standard is outside the definition.

☐ Run the four-factor risk assessment: the nature and extent of the information including identifiers and re-identification risk; the unauthorized person involved; whether the information was actually acquired or viewed; and the extent to which the risk has been mitigated.

☐ Document the assessment in writing whatever the conclusion. The documentation is the defense if no notice is given.

☐ Presume a breach unless the assessment demonstrates a low probability of compromise. The burden is on the entity.

☐ Determine the number of affected individuals and their states of residence.

☐ Identify every applicable regime: HIPAA, each state breach statute, 42 C.F.R. part 2 if applicable, contractual obligations, and any sector rule.

Part 7 — Notification

☐ Individuals: without unreasonable delay and no later than 60 days after discovery.

☐ Method: first-class mail, or email if the individual agreed. Substitute notice where contact information is insufficient — website posting or media, plus a toll-free number for ten or more.

☐ Content: what happened and when; the types of information involved; steps individuals should take; what you are doing; and contact procedures including a toll-free number.

☐ HHS: within 60 days for breaches affecting 500 or more; annually within 60 days after year-end for smaller ones.

☐ Media: prominent outlets in the state or jurisdiction for breaches affecting more than 500 residents of that state.

☐ State regulators on their own deadlines, which are frequently shorter.

☐ Business associate to covered entity within the contractual period, generally 60 days, identifying affected individuals.

☐ Stand up a call center and prepare a script before notices arrive.

☐ Offer credit or identity monitoring where appropriate; note it is not required by HIPAA and may be required by state law or contract.

☐ Keep a copy of every notice and the mailing evidence.

Part 8 — After the Notification

☐ Update the risk analysis to reflect what the incident revealed.

☐ Close the underlying finding with an owner and a date.

☐ Apply sanctions consistently and document them.

☐ Retrain the affected workforce and, where appropriate, everyone.

☐ Review the business associate agreement and consider indemnification.

☐ Expect an inquiry. A large breach report frequently produces an investigation that asks about the program, not primarily about the incident.

☐ Retain the entire file for six years.

Part 9 — Responding to a Complaint or Investigation

☐ Preserve everything immediately; issue a litigation hold. See the ESI checklist.

☐ Identify a single point of contact and route all communications through counsel.

☐ Assemble the six documents an investigation asks for first: the current risk analysis; the business associate inventory and agreements; training records; audit log review evidence; the policies covering the practice at issue; and the incident documentation.

☐ Answer completely and on time, and request extensions in writing rather than missing a date.

☐ Do not remediate silently and claim nothing happened. Correct the problem and describe the correction.

☐ Interview the workforce members involved, with counsel, and document it.

☐ Assess exposure honestly against the culpability tiers of 42 U.S.C. § 1320d-5, including whether the conduct constitutes willful neglect and whether it was corrected within thirty days.

☐ Consider whether a corrective action plan and resolution agreement is the realistic outcome, and negotiate its terms and duration.

☐ Watch for parallel exposure — state attorney general action under 42 U.S.C. § 17939, state statutory claims, and class litigation.

☐ Never retaliate against a complainant, which is independently prohibited.

Part 10 — Building the Program

☐ Name a privacy official and a security official in writing.

☐ Complete an enterprise-wide risk analysis covering every system, device, location, and vendor.

☐ Build a risk management plan with owners and dates, and close the findings.

☐ Inventory every business associate and execute agreements with flow-down to subcontractors.

☐ Encrypt laptops, phones, tablets, and removable media.

☐ Implement role-based access and prompt deprovisioning at separation.

☐ Review audit logs on a defined schedule and document the review.

☐ Publish and distribute a notice of privacy practices and obtain acknowledgment where required.

☐ Build an access-request workflow with a named owner, a thirty-day calendar, and a compliant fee schedule.

☐ Build an incident response procedure with the discovery clock and the four-factor assessment.

☐ Train at hire, annually, and after changes, with documentation.

☐ Adopt and apply a sanctions policy consistently.

☐ Retain documentation for six years.

☐ Gate procurement so no vendor touches protected health information without review.

Part 11 — Annual Audit

☐ Is the risk analysis current, and does it cover systems added this year? ☐ Are all risk management findings closed, or tracked with dates? ☐ Does the business associate inventory match reality, including tools added by departments? ☐ Are all agreements executed and flowed down? ☐ Are all portable devices encrypted? ☐ Have audit logs been reviewed, and is the review documented? ☐ Were all access requests answered within thirty days, at a compliant fee? ☐ Was every incident assessed and documented, including those that produced no notice? ☐ Is training complete and documented for everyone? ☐ Were sanctions applied consistently? ☐ Do the policies match what people actually do? ☐ Is the notice of privacy practices current with recent rulemaking? ☐ Do state-specific requirements — deadlines, categories, fees — appear in the workflows?

Part 12 — Special Record Categories

☐ Psychotherapy notes — maintained separately, authorization required for most disclosures including treatment.

☐ 42 C.F.R. part 2 substance use records — consent management and segregation, restricted use in legal proceedings, court order with specific criteria for disclosure.

☐ Mental health information generally — stricter under most state statutes.

☐ HIV, communicable disease, and genetic information — specific consent and redisclosure limits in most states.

☐ Reproductive health information — attestation requirements for defined categories of request; segregate where feasible.

☐ Minors' records — controlled by the minor where state law permits the minor to consent; watch portals, reminders, and explanation-of-benefits statements.

☐ Decedents' records — protected for fifty years; personal representative controls.

☐ Employment-related medical information — governed by 42 U.S.C. § 12112 confidentiality on the employer side.

Part 13 — Mistakes That Produce Enforcement

☐ No risk analysis, or one that does not cover all systems. ☐ A vendor holding data with no business associate agreement. ☐ An unencrypted laptop or phone. ☐ Access requests answered late, or charged for search and retrieval time. ☐ Employee access to records of patients they were not treating, never detected because logs were never reviewed. ☐ Starting the breach clock when the forensic report arrived rather than at discovery. ☐ Notifying without documenting the four-factor assessment — or deciding not to notify and documenting nothing. ☐ Missing a state deadline shorter than sixty days. ☐ Treating an individual's access request as a third-party records request. ☐ Producing records on a bare civil subpoena without the required assurances. ☐ Sending 42 C.F.R. part 2 records under a HIPAA authorization. ☐ Marketing or analytics technology transmitting identifiable data to a third party. ☐ Inconsistent discipline for the same conduct. ☐ Policies that do not match practice.

Part 14 — The Authority Behind Each Step

☐ Covered entity status. 42 U.S.C. § 1320d-1; definitions at 42 U.S.C. § 1320d.

☐ Privacy, Security, and Breach Rules. 45 C.F.R. part 164; general provisions and enforcement at 45 C.F.R. part 160; transactions at part 162.

☐ Standards adoption. 42 U.S.C. § 1320d-2, § 1320d-3, § 1320d-4.

☐ Business associate obligations. 42 U.S.C. § 17931 and § 17934; definitions at § 17921.

☐ Breach notification. 42 U.S.C. § 17932.

☐ Restrictions, accounting, marketing, and sale. 42 U.S.C. § 17935 and § 17936.

☐ Personal health record vendors. 42 U.S.C. § 17937; FTC rule at 16 C.F.R. part 318.

☐ Civil penalties. 42 U.S.C. § 1320d-5. Criminal penalties. § 1320d-6.

☐ State attorney general enforcement. 42 U.S.C. § 17939; audits at § 17940.

☐ Preemption. 42 U.S.C. § 1320d-7.

☐ Employment use. 42 U.S.C. § 1320d-8; employer-side confidentiality at 42 U.S.C. § 12112.

☐ Substance use records. 42 U.S.C. § 290dd-2; 42 C.F.R. part 2.

☐ Information blocking and certification. 42 U.S.C. § 300jj-51, § 300jj-52; 45 C.F.R. part 171 and part 170.

☐ Research. 45 C.F.R. part 46.

☐ Financial safeguards where applicable. 15 U.S.C. § 6801, § 6802, 16 C.F.R. part 314.

Part 15 — Decision Trees

Is this entity covered by HIPAA at all?

1. Is it a health plan, a clearinghouse, or a provider transmitting health information electronically for a covered transaction? → Covered entity.
2. Does it create, receive, maintain, or transmit protected health information on behalf of a covered entity? → Business associate, directly liable.
3. Is it a subcontractor of a business associate doing the same? → Also a business associate.
4. Is it an employer, a school, a life insurer, a fitness app, or a direct-to-consumer testing company not billing insurance? → Not covered by HIPAA. Look to state consumer health privacy law, consumer protection law, and 16 C.F.R. part 318.

May I disclose this without authorization?

1. Is it to the individual, or to someone they have agreed may receive it? → Yes.
2. Is it for treatment, payment, or health care operations? → Yes, subject to minimum necessary except for treatment.
3. Is it required by law, or in response to a court order? → Yes, limited to what is required or authorized.
4. Does it fit a public health, oversight, abuse reporting, law enforcement, decedent, organ donation, research, serious-threat, government function, or workers' compensation permission? → Yes, within that permission's limits.
5. Is it marketing, a sale of information, or a use of psychotherapy notes? → Authorization required.
6. Are these 42 C.F.R. part 2, mental health, HIV, genetic, or reproductive health records? → Check the stricter rule first.
7. None of the above? → Authorization required.

Is this a reportable breach?

1. Was the use or disclosure permitted? If yes → not a breach.
2. Does one of the three exceptions apply? If yes → not a breach.
3. Was the information encrypted to the specified standard? If yes → outside the definition.
4. Run the four-factor assessment. Can you demonstrate a low probability of compromise? If no → it is a breach; the presumption is against you.
5. Document the assessment either way.
6. Count the affected individuals and identify their states. Apply the shortest applicable deadline.

Can I charge for these records?

1. Is the requester the individual, or a third party the individual directed in writing? → Access right. Cost-based fee only; no search and retrieval time.
2. Is the requester a third party with an authorization? → Not the access right; state fee schedules may apply.
3. Is the request from another provider for treatment? → Generally no fee, and delay may implicate 45 C.F.R. part 171.
4. Does the individual owe an unrelated balance? → Irrelevant. Access may not be conditioned on it.

Do I have to give this to law enforcement?

1. Is there a court order or a grand jury subpoena? → Disclose what it authorizes.
2. Is it an administrative request meeting the regulatory conditions — relevant, specific, and de-identified information not usable? → Possibly, within limits.
3. Is it a request to identify or locate a suspect? → Limited to specified identifiers only.
4. Is it about a crime victim? → Generally requires agreement, with narrow exceptions.
5. Is it an informal request with no process? → Decline and escalate.

Part 16 — Timing Reference

Event	Deadline	Source
Respond to an access request	30 days, one 30-day extension on written notice	45 C.F.R. part 164
Notify individuals of a breach	60 days from discovery	42 U.S.C. § 17932
Notify HHS — 500 or more individuals	60 days from discovery	Same
Notify HHS — fewer than 500	Within 60 days after the calendar year ends	Same
Notify media — more than 500 residents of a state	60 days from discovery	Same
Business associate notifies covered entity	Generally 60 days, or the contractual period	Same
State breach notification	Frequently shorter than 60 days	State statute
File an OCR complaint	180 days from when the complainant knew or should have known	45 C.F.R. part 160
Correct willful neglect to reduce penalties	30 days	42 U.S.C. § 1320d-5
Retain required documentation	6 years from creation or last effective date	45 C.F.R. part 164
Accounting of disclosures period	6 years	Same
Protection of a decedent's information	50 years after death	Same

Related Documents

• Health Information Privacy: A Comprehensive Guide to HIPAA, Access Rights, and Breach Notification
• Who Is Allowed to Read Your Chart: How Health Privacy Law Actually Works
• The HIPAA Compliance and Breach Response Toolkit
• Running the First Seventy-Two Hours of a Security Incident: A Practical Checklist
• Cybersecurity Incidents and Breach Response: A Comprehensive Guide to Notification, Regulators, and Liability
• Patient Rights and Medical Records: A Comprehensive Guide to Access, Consent, and Complaints
• Issuing a Litigation Hold and Running an ESI Production: A Practical Checklist
• Tendering a Claim and Contesting a Coverage Denial: A Practical Checklist
• Health Care Fraud and Abuse: A Comprehensive Guide to the Anti-Kickback Statute, Stark Law, and Overpayments
• Auditing a Referral Arrangement and Answering an Overpayment Demand: A Practical Checklist
• Data Privacy and Security: A Comprehensive Guide to Collection, Consent, Breach, and Enforcement
• Mental Health and Civil Commitment: A Comprehensive Guide to Standards, Hearings, and Rights