SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-security-incident-procedures

What must a healthcare group do about security incidents?

It must respond to and report security incidents.

Start playing free

  1. Ignore malware alerts
  2. Notify the media immediately
  3. Respond to and report security incidents ✔

Why: The Security Rule requires policies and procedures to address security incidents, including response and reporting. Incidents can include malware, stolen laptops, or unauthorized access.

Huh, didn't know that: Reporting helps contain the incident and may affect breach notification duties.

The dad joke
Why did the incident response team wear running shoes? To respond quickly to security slips.
Like this card?
Play the game

References

Answer: Respond to and report security incidents. The Security Rule requires policies and procedures to address security incidents, including response and reporting. Incidents can include malware, stolen laptops, or unauthorized access.

  1. 45 CFR 164.308(a)(6)(i) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
    Implement policies and procedures to address security incidents.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.