Incident Response Plan for Home Health Agencies (with Template)

HIPAA requires covered entities to have a documented security incident response plan, and most small home health agencies don't have one — not because the requirement is obscure, but because writing an incident response plan tends to get pushed down the priority list until an actual incident forces the question. That's exactly backwards: the entire value of a plan is that it exists before anyone needs it, written by people thinking clearly, rather than improvised in the middle of a ransomware attack by whoever happens to be in the office that day.

Below is what the plan needs to cover, the HIPAA notification deadlines that drive its timeline, and actual template language organized around the standard incident response phases — detection, containment, eradication, and recovery — that you can adapt directly into your agency's own plan.

Why a Written Plan Matters More Than It Seems

An incident response plan isn't primarily a document for a calm afternoon of compliance paperwork — it's a document for the worst morning of the year, when a caregiver reports a phishing email they clicked, or the EHR won't load because every file on the network is suddenly encrypted. In that moment, the plan's entire job is to replace panic and improvisation with a short, known sequence of steps: who gets called first, what gets isolated immediately, who decides whether this is reportable, and who talks to patients, staff, and regulators. Agencies without a plan don't skip these steps — they do them anyway, just slower, under worse conditions, and often in the wrong order, which is how a contained incident turns into a much larger one.

The HIPAA 60-Day Notification Requirement

HIPAA's Breach Notification Rule (45 CFR §§ 164.400–414) sets firm deadlines once a breach of unsecured PHI is discovered. Affected individuals must be notified without unreasonable delay and in no case later than 60 days after discovery. If the breach affects 500 or more individuals, HHS must also be notified within that same 60-day window, and the agency must notify prominent media outlets serving the affected area. If the breach affects fewer than 500 individuals, HHS can be notified on an annual basis — within 60 days of the end of the calendar year in which the breach was discovered — rather than immediately, though individual notification still follows the 60-day rule regardless of breach size.

The 60-day clock starts at discovery, not at the point the full scope of the incident is understood, which is why an agency's own detection speed matters as much as its response speed — a breach that sat undetected for three months before anyone noticed doesn't get three extra months of runway on notification once it is finally discovered. If the agency relies on a business associate's system (the EHR vendor, a cloud backup provider) for part of the incident, the business associate is required to notify the agency without unreasonable delay and no later than 60 days from its own discovery — which is exactly why the BAA's breach notification clause, covered in vendor assessments, directly determines how much of the 60-day window the agency actually has left to act once it's told.

The Four Phases of Incident Response

A workable incident response plan is organized around four phases, each with its own specific actions rather than a single generic "respond to incidents" instruction.

1. Detection

Detection covers how an incident gets identified and reported in the first place — a monitored SOC alert, a caregiver reporting a suspicious email or an unresponsive device, an EHR vendor notification, or a patient reporting unusual activity on their own account. The plan needs a single, well-known reporting channel (a phone number or email that goes to the right person immediately, staffed or monitored around the clock) so that whoever notices something doesn't have to figure out who to tell.

2. Containment

Containment stops the incident from spreading further while the investigation continues — disconnecting an affected device from the network, disabling a compromised account, or isolating an affected system segment. The goal in this phase isn't to fully understand or fix the problem yet, it's to stop the bleeding immediately, even imperfectly, because every additional hour an active intrusion continues is more data at risk and a longer recovery later.

3. Eradication

Eradication removes the actual cause — malware, a compromised credential, an unpatched vulnerability that was exploited — rather than just the symptom that triggered detection. Restoring a device from backup without first understanding and closing the hole the attacker used is a common mistake that leads directly to a second incident through the same door.

4. Recovery

Recovery restores normal operations: systems brought back online, verified clean, and monitored closely for any sign the issue wasn't fully resolved. This phase also includes the notification obligations above, and a post-incident review — what happened, what worked, what didn't, and what changes to the plan or the agency's controls should follow, so the same incident doesn't happen the same way twice.

Template: Incident Response Plan

The sections below are written as adaptable template text for a home health agency's incident response plan. Replace the bracketed placeholders with your agency's actual details.

1. Purpose

This plan establishes [Agency Name]'s procedure for detecting, responding to, and recovering from security incidents involving protected health information (PHI) or agency systems, and for meeting HIPAA's breach notification requirements under 45 CFR §§ 164.400–414.

2. Incident Response Team

The following individuals form [Agency Name]'s incident response team: Incident Lead — [name/title], responsible for coordinating the overall response. Technical Lead — [name/title or IT/managed security provider], responsible for containment and eradication. Compliance Lead — [name/title], responsible for determining breach notification obligations and coordinating with legal counsel. Communications Lead — [name/title], responsible for staff, patient, and media communication if required.

3. Reporting an Incident

Any employee, contractor, or volunteer who suspects a security incident — a phishing email, a lost or stolen device, unusual system behavior, or any unauthorized access to PHI — must report it immediately to [phone number / email], available [24/7 / during business hours with after-hours escalation to X]. Do not delay reporting to investigate further on your own.

4. Containment Procedures

Upon confirmation of an incident, the Technical Lead will isolate affected systems or accounts within [timeframe, e.g., one hour of confirmation], including disconnecting affected devices from the network, disabling compromised credentials, and preserving relevant logs for investigation before any system is altered or restored.

5. Investigation and Eradication

The Technical Lead, with support from [managed security provider / IT vendor], will determine the root cause and scope of the incident, including what data or systems were affected and how the incident occurred, before removing the cause and restoring affected systems.

6. Breach Determination and Notification

The Compliance Lead will determine whether the incident constitutes a reportable breach of unsecured PHI under HIPAA. If so, [Agency Name] will notify affected individuals without unreasonable delay and no later than 60 days after discovery, notify HHS within the applicable timeframe based on the number of individuals affected, and notify media outlets if 500 or more individuals in a state or jurisdiction are affected.

7. Staff Notification and Internal Communication

The Communications Lead will notify affected staff of relevant details and any required actions (password resets, device replacement, additional monitoring) within [timeframe] of containment, and will coordinate all external communication regarding the incident to ensure consistent, accurate messaging.

8. Post-Incident Review

Within [30 days] of resolution, the incident response team will conduct a review covering what occurred, how it was detected and handled, and what changes to policy, training, or technical controls are needed to reduce the likelihood of recurrence. This review will be documented and retained as part of [Agency Name]'s HIPAA compliance records.

Testing the Plan Before You Need It

A plan that's never been reviewed outside of the document itself tends to fail in exactly the places nobody thought to specify — an outdated phone number for the Incident Lead, a Technical Lead who left the agency eight months ago and was never replaced in the plan, a containment step that assumes system access nobody currently has. A short annual tabletop exercise — walking through a realistic scenario (a phishing-based credential compromise, a lost device, a ransomware alert) and talking through exactly what each team member would do — surfaces these gaps while they're still hypothetical rather than during an actual incident.

How ShieldForce Supports Incident Response

ShieldForce provides 24/7 SOC monitoring and incident response support as part of the complete home health cybersecurity platform we manage for agencies — detection and containment happen immediately rather than waiting for business hours, and our team works directly with your agency's incident response plan rather than replacing it, since the compliance and notification decisions remain the agency's own responsibility under HIPAA. For the complete HIPAA Security Rule mapping beyond incident response specifically, see our home health cybersecurity guide.

Frequently Asked Questions

How long do we have to notify patients after discovering a breach?

HIPAA requires notification to affected individuals without unreasonable delay and no later than 60 days after discovery of the breach. The clock starts at discovery, not once the full scope of the incident is understood, which is why fast detection matters as much as a fast response.

Do we have to notify HHS immediately, or can it wait?

It depends on the number of individuals affected. A breach affecting 500 or more individuals must be reported to HHS within 60 days, the same window as individual notification. A breach affecting fewer than 500 individuals can be reported to HHS annually, within 60 days of the end of the calendar year in which it was discovered.

What's the difference between containment and eradication?

Containment stops an incident from spreading further — isolating a device or disabling a compromised account — without necessarily understanding or fixing the underlying cause yet. Eradication removes the actual cause, such as malware or the vulnerability that was exploited, so the same incident can't simply recur the same way once systems are restored.

Does a small home health agency really need a formal incident response plan?

Yes. HIPAA's Security Rule requires a documented security incident response procedure regardless of agency size, and the absence of one is a commonly cited deficiency in OCR enforcement actions following an incident. A plan doesn't need to be elaborate to be compliant, but it does need to exist in writing and assign specific responsibilities to specific people.

How often should the incident response plan be tested or updated?

At least annually, through a tabletop exercise that walks through a realistic scenario, and immediately after any staffing change affecting someone named in the plan. A plan with an outdated contact or a role nobody currently fills will fail at the exact moment it's needed most.