When a privacy breach involves patient information, which sequence of steps is recommended?

• A. Notify authorities first, then assess risk, then contain the breach, and document.
• B. Contain the breach, assess risk, notify affected individuals and authorities as required, document, and implement corrective actions.
• C. Ignore the breach if no one notices, and continue care.
• D. Only inform patients and wait for further instructions.

Answer: (B)

In handling a privacy breach involving patient information, the first priority is to stop the exposure and secure the information. Containing the breach right away limits further harm and preserves evidence. Once containment is in place, assess the risk to determine how serious the impact could be and what needs to be done next—this informs who must be notified and what actions are required. After the risk is understood, notify the affected individuals and the appropriate authorities as required by policy or law, following any mandated timelines. It’s crucial to document every step: what occurred, actions taken, decisions made, and notifications issued, so there’s a clear audit trail. Finally, implement corrective actions to address root causes and reduce the chance of a recurrence.

Other approaches fall short because they delay containment, skip required notifications or oversight, or ignore the breach altogether, which can increase harm and liability.