If something goes wrong: privacy breach basics

What counts as a breach

• A lost or stolen laptop, phone or USB key
• Information sent to the wrong recipient
• A staff member looking at a record they had no reason to see
• An account taken over by someone else
• Ransomware or another cyberattack

The first five steps

1. Contain it.

   Stop the harm from growing.

   Recall the email, retrieve the paper, lock the account, change the password, disconnect the device.

2. Assess it.

   The risk decides who you must tell.

   What information, how many people, how sensitive, and how likely it is to be misused.

3. Get your vendor’s facts.

   If a vendor was involved, you need its account to notify anyone.

   Ask what happened, when, which records, and what has been done.

4. Notify by your law’s deadline.

   Every law below sets its own.

   Use the table. When in doubt, call your privacy officer the same day.

5. Record it.

   Every law expects a record, including breaches you did not have to report.

   What happened, when you found out, what you did, and who you told.

Who to notify, and when

Who to notify, and when

Law	Patients	Regulator	Records	Source
Ontario (PHIPA)	At the first reasonable opportunity	IPC at the first reasonable opportunity, in the cases the regulation lists	Annual statistics to the IPC by March 1, if you had any breach	Official source
Québec	Promptly, when there is a risk of serious injury	The Commission promptly; under the health information act, the Minister too	A register of every incident	Official source
PIPEDA	As soon as feasible, when there is a real risk of significant harm	Office of the Privacy Commissioner, as soon as feasible	A record of every breach, kept for two years	Official source
HIPAA	Without unreasonable delay, within 60 days	HHS within 60 days for 500 or more people; within 60 days after year end for fewer. Media when more than 500 residents of a state or jurisdiction	Documentation kept for six years	Official source
PulseAI, as your vendor	Your clinic notifies, as custodian or covered entity	Your clinic notifies	If anything is ever accessed or shared without permission, we tell you right away.	Trust Center

Why it matters

Regulators judge a breach by how the clinic responded. A fast, recorded, honest response is what keeps a small incident small.

Common mistakes

• Waiting for every fact before telling anyone.
• Recording only the breaches that were reported.
• Not asking the vendor for a written account.

How PulseAI helps

• If anything is ever accessed or shared without permission, we tell you right away.
• If a breach ever happens, we tell you without delay, as the law requires.
• A log of who touched what, kept for seven years in your clinic’s own country, and yours whenever you ask.

See how we protect your data on the Trust Center.

Questions, answered