When patient information is emailed to the wrong person, act promptly, but don’t panic or assume you know the final outcome. The first priority is to alert the practice’s privacy or security lead and follow the practice’s incident procedures. A request to delete the message may help limit exposure, but it does not replace an assessment of what happened or whether notification is required.
Use this checklist to respond, document the incident, and leave decisions about HIPAA breach notification to the designated lead. If your practice has a written response plan, follow it rather than improvising.
What to do first
- Notify the right person internally. Tell the privacy or security lead, practice manager, or other designated contact as soon as possible. If you are not sure who that is, contact your supervisor and ask them to connect you. Use the practice’s approved channel for sharing incident details, and avoid sending more patient information than necessary.
- Preserve the original message and details. Don’t delete the sent email or alter its contents. Keep it in the approved location so the designated lead can review the recipient, message, and any attachments. Don’t forward it broadly or make extra copies unless the response process calls for that.
- Stop further exposure where you can. Don’t send a follow-up containing more patient information. If the email system has an approved recall or access-removal option, ask the designated lead or IT support whether to use it. A recall attempt is not proof that the message was removed or never viewed.
- Let the lead coordinate contact with the recipient. The practice may ask the unintended recipient not to open, share, or retain the message and to delete it, then confirm what they did. Use a verified contact method and follow practice procedures. Don’t assume a deletion request alone resolves the incident.
For a broader response framework, see Zevonix’s guide to security breach response planning.
Can we ask the recipient to delete the email?
Yes, asking the unintended recipient to delete the email and confirm deletion can be a sensible mitigation step when it is appropriate and coordinated through the practice’s procedures. The recipient’s response is useful information for the assessment. It does not, by itself, establish whether the information was accessed, whether other copies exist, or whether the incident requires notification.
If the recipient is known to the employee, don’t rely on an unverified address or assume that a reply came from the right person. The practice’s designated lead should decide how to make contact and record the response. If the recipient does not reply, says the message was opened, or indicates it was shared, report that promptly to the lead.
Document the incident while details are fresh
A clear, factual record helps the practice understand the scope of the disclosure and explain what it did in response. Record what is known, distinguish it from what is still uncertain, and update the record as new details come in. Follow the practice’s secure recordkeeping process.
- When it happened: Record when the email was sent, when the mistake was noticed, and when it was reported internally.
- What was sent: Note the message’s subject and contents, the type of patient information involved, and whether it included attachments. Avoid creating unnecessary additional copies of sensitive content.
- Whose information may be involved: Identify the affected patient or patients using the practice’s approved process. If the scope is not yet clear, say so and document how it will be checked.
- Who received it: Record the intended and actual recipient addresses, whether the recipient is known to the practice, and any relevant details about the recipient’s role or organization.
- What is known about access: Record whether the message or attachment was opened, downloaded, retained, or shared, if that information is available. Note how the practice checked and what remains unknown.
- What the practice did: Record containment steps, attempts to recall or remove access, contact with the recipient, any deletion confirmation, internal notifications, and the times and people involved.
- What happens next: Document who is assessing the incident, what information is still needed, and the practice’s decisions about mitigation, notification, and follow-up.
Who should assess whether it is a breach?
The practice’s designated privacy or compliance lead should coordinate the assessment under the practice’s procedures. The employee who sent the email should report the facts, but should not make a solo decision about whether the event is reportable. Bring in the appropriate security, management, or compliance contacts as the response plan directs. If the situation is unclear or complex, the practice may need qualified compliance or legal guidance.
A misdirected email containing PHI does not automatically have the same outcome in every situation. The assessment should consider what information was involved, who received it, whether it was accessed or further shared, and what the practice did to limit exposure. The lead should also consider applicable HIPAA, state, and contractual requirements. Keep the incident response moving while that assessment is underway; internal escalation should not wait for a final notification decision.
Notification decisions should follow the completed assessment and applicable requirements. The designated lead should determine whether affected patients, HHS, or other parties need to be notified and what process and timing apply. Don’t promise that notification is or is not required before that review is complete.
If the email involved an attachment or several patients
Check the contents of the message and every attachment through the practice’s approved process. An attachment may contain information that is not obvious from the email subject or body. If the message went to a group, verify each recipient and whether anyone replied, forwarded it, or otherwise shared it.
When multiple patients may be involved, ask the designated lead how to establish the scope securely. Record the number of records or people involved only after it has been checked. Don’t send the attachment around internally just to find out what it contains.
Should the employee be disciplined or retrained?
First, gather facts and contain the disclosure. Avoid making a snap judgment about intent or discipline while the incident is still being assessed. The practice can later review whether a workflow, training gap, or individual action contributed, and decide on appropriate coaching or other follow-up under its policies.
Prevention can include checking recipients before sending, taking care with email autocomplete, confirming group addresses, and reviewing attachments before sending. If email controls or procedures need attention, Zevonix’s overview of email security for businesses may help inform that review. For planning how to coordinate technical and operational steps during an incident, see incident response services for small firms.
Frequently asked questions
What should we do first if an employee emails patient information to the wrong person?
Notify the practice’s designated privacy or security lead, preserve the original email and relevant details, and follow the incident procedures. Don’t wait to report internally while trying to decide whether the event is a breach.
Does sending PHI to the wrong address automatically count as a HIPAA breach?
Not every incident has the same outcome. The designated lead should assess the circumstances and applicable requirements rather than treating a deletion request or the employee’s assumptions as the final decision.
What if we don’t know whether the recipient opened the email?
Record that access is unknown, note what steps were taken to check, and share the uncertainty with the person conducting the assessment. Don’t present an unverified assumption as a confirmed fact.
When should patients or HHS be notified?
The designated lead should determine whether notification is required and follow the applicable process and timing after assessing the incident. This depends on the circumstances and relevant requirements, so don’t guess or make a blanket promise.
Respond promptly, then strengthen the process
A calm response helps the practice contain a misdirected email, preserve reliable information, and make a considered assessment. Start by notifying the designated lead and following your incident procedures. If your practice wants help reviewing its incident response or HIPAA compliance support, contact Zevonix at (904) 658-0777.