SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-report-suspected-breach

What should you do if you suspect a breach?

Report it right away to your privacy officer or as your workplace policy says.

Start playing free

  1. Wait to see if anyone complains
  2. Fix it quietly yourself
  3. Report it right away to the privacy officer ✔

Why: Organizations must have procedures to identify, respond to and document suspected incidents. Reporting fast lets them assess the risk, limit harm and meet the notice deadlines.

Huh, didn't know that: If any worker knows about a breach, the law treats the organization as knowing, so the notice clock may already be running.

The dad joke
Why did the worker call the privacy officer right away? Better safe than sorry.
Like this card?
Play the game

References

Answer: Report it right away to the privacy officer. Organizations must have procedures to identify, respond to and document suspected incidents. Reporting fast lets them assess the risk, limit harm and meet the notice deadlines.

  1. 45 CFR 164.308(a)(6) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
    Identify and respond to suspected or known security incidents
    Checked 2026-10-10.
  2. 45 CFR 164.404(a)(2) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
    A covered entity shall be deemed to have knowledge of a breach if such breach is known
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsNurse Kim looks up her neighbor's chart out of curiosity. Is that allowed?Work SkillsTwo nurses need to discuss a patient in a hospital elevator. What should they do?Work SkillsIs posting patient photos or stories on social media allowed?

That's stuff everyone should know.