[ORGANIZATION NAME]
[ADDRESS]
[PHONE]
[DATE]
[PATIENT NAME]
[PATIENT ADDRESS]
[CITY, STATE ZIP]
RE: NOTICE OF BREACH OF UNSECURED PROTECTED HEALTH INFORMATION
Dear [PATIENT NAME]:
We are writing to inform you of a security incident that may have affected the privacy of your health information. We take the privacy and security of your information very seriously, and we want to provide you with information about this incident, what we are doing about it, and the steps you can take to protect yourself.
1. WHAT HAPPENED
On [DATE OF BREACH/DATE RANGE], we discovered that [DESCRIPTION OF INCIDENT]. [DESCRIBE HOW BREACH OCCURRED - e.g., "An employee inadvertently sent a patient list to an incorrect email address" or "Our billing system was accessed by unauthorized individuals due to a security vulnerability"].
We immediately initiated an investigation with the assistance of [FORENSIC FIRM/IT VENDOR if applicable] to determine the scope of the incident and whether any of your information was involved.
2. WHAT INFORMATION WAS INVOLVED
Based on our investigation, we have determined that the following types of information about you may have been involved in this incident:
[ ] Name and address
[ ] Social Security number
[ ] Date of birth
[ ] Insurance information
[ ] Medical record number
[ ] Diagnosis and treatment information
[ ] Prescription information
[ ] Medical history
[ ] Billing information
[ ] Credit card or bank account information
[ ] Other: [DESCRIBE]
3. WHAT WE HAVE DONE
Upon discovery of this incident, we took the following steps:
- Immediately secured our systems to prevent further unauthorized access
- Launched a comprehensive investigation to determine what information was accessed
- [If applicable] Notified law enforcement agencies
- Implemented additional security controls to prevent similar incidents
- [If applicable] Engaged external security experts to provide recommendations
- Notified our workforce members about this incident and reinforced security protocols
- Reviewed our security practices to identify areas for improvement
We have found no evidence that your information has been used inappropriately or that your information is currently being misused. However, we understand that you are concerned about the security of your health information.
4. STEPS YOU SHOULD TAKE
While we have no evidence that your information has been misused, we recommend that you take the following steps to protect yourself:
Monitor Your Credit and Accounts:
- Obtain free credit reports from www.annualcreditreport.com
- Review credit reports for accounts you did not open
- Place a fraud alert with the major credit bureaus if appropriate
- Consider a credit freeze if you are concerned about identity theft
Watch for Suspicious Communications:
- Be cautious of unsolicited calls, emails, or letters requesting personal information
- Report suspicious activity to the entity requesting information
- Do not respond to requests for personal information via email
Report Suspicious Activity:
- If you notice any suspicious activity related to your accounts, contact your financial institution immediately
- Report identity theft to the Federal Trade Commission at www.IdentityTheft.gov
- File a report with local law enforcement if you believe you are a victim of identity theft
Contact Us With Questions:
- If you have questions about this incident or your health information, contact [NAME] at [PHONE] or [EMAIL]
5. IDENTITY MONITORING SERVICES
[OPTIONAL - Include if offering identity monitoring services]
At no cost to you, we are offering [DURATION]-months of complimentary credit monitoring and identity theft protection services through [PROVIDER]. These services include:
- Credit monitoring and alerts
- Identity theft insurance ($[AMOUNT] coverage)
- Fraud recovery assistance
- Dark web monitoring
To enroll in these services, visit [WEBSITE] or call [PHONE NUMBER]. Your enrollment code is: [CODE]
You must enroll by [DATE] to receive these services.
6. REGULATORY INFORMATION
Under the HIPAA Breach Notification Rule, we are required to notify you of this incident. The Breach Notification Rule requires healthcare providers to implement safeguards to protect the privacy and security of health information.
If you have concerns about our privacy practices, you may file a complaint with:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Or submit a complaint online at:
https://www.hhs.gov/hipaa/filing-a-complaint/index.html
7. MORE INFORMATION
We deeply regret this incident and recognize the concern it may cause you. We remain committed to protecting the privacy and security of your health information. If you have questions about this incident, our security practices, or steps you can take to protect yourself, please contact:
[CONTACT PERSON NAME]
[TITLE]
[ORGANIZATION NAME]
[ADDRESS]
[PHONE]
[EMAIL]
We are available to discuss this matter [HOURS OF AVAILABILITY].
Thank you for your patience and understanding as we work to resolve this matter and strengthen our security measures.
Sincerely,
[SIGNATURE]
[NAME]
[TITLE]
[ORGANIZATION NAME]
---
ENCLOSURES (if applicable):
- Information about credit monitoring services
- Information about fraud prevention and identity theft
- Frequently asked questions about the incident