Five Decisions Every Healthcare Organization Should Make Before a Breach

Five Decisions Every Healthcare Organization Should Make Before a Breach

Healthcare has been the most expensive industry for data breaches for 13 years running, according to IBM’s 2026 Cost of a Data Breach Report, with an average cost of $6.64 million per incident. In the first half of 2026 alone, 189 large healthcare breaches were reported to HHS, affecting more than 19 million people, and roughly nine in ten involved hacking or IT incidents.

Those numbers are driven by large health systems, but the pattern is the same at a 12-provider practice or a 40-person billing company. The difference is that smaller organizations rarely have a privacy officer, counsel on retainer or a forensics firm on call. When something happens, they are making their most consequential decisions in the first few hours, often without anyone in the room who has done it before. Most of those decisions can be made in advance.

1. Who makes the call that something is an incident?

Most organizations have no defined threshold. A missing laptop, a misdirected email or a vague vendor notice sits in someone’s inbox because nobody is sure it rises to the level of a problem. Under HIPAA, an impermissible disclosure is presumed to be a breach unless the organization documents otherwise, and the clock runs from discovery. Name the person who decides, and give them a simple intake checklist.

2. Who is your lawyer, and do they already know you?

Finding counsel in the middle of an incident means conflict checks, engagement letters and hours spent explaining your systems while the response stalls. Organizations that bring counsel in early can also keep the investigation organized around legal advice, which shapes how the record reads later.

3. Do you know what your vendor contracts require?

Business associate agreements often set notification deadlines far shorter than the regulation’s 60 days, sometimes as short as a few days. If you are a vendor, your customers’ contracts may already be the binding deadline.

4. Who speaks for the organization?

Patients, staff, payers and sometimes the press will all ask questions. Inconsistent answers create problems that outlast the incident itself. Decide in advance who communicates, and what is reviewed before anything goes out.

5. Have you practiced?

A plan that has never been tested is mostly a document. A two-hour tabletop exercise walking through a realistic scenario will expose more gaps than any policy review.

The bottom line

None of these decisions requires a large budget. They require deciding now, while there is time to think, rather than in the first hour of an incident.

Timothy M. Wogan, JD, CHC, is the founder of Wogan Health Law, which provides breach incident counsel to healthcare organizations. Through its Prepared Partner Program, the firm helps medical and dental practices, business associates and health technology vendors put these decisions in place before an incident occurs. Learn more at timothymwogan.com.