The incident response plan is a required component of your SHIN-NY Cybersecurity Policies and Procedures Program. Every RHIO that reviews CSPP documentation looks for it. But a plan that exists on paper and a plan that actually functions during a 2am security incident are very different things — and your RHIO's reviewers have seen enough ineffective plans to know the difference.
This guide explains what a SHIN-NY-compliant incident response plan must contain, how to structure it so it is actually usable under pressure, and the specific RHIO notification requirements it must address.
What Makes an Incident Response Plan SHIN-NY-Compliant
A SHIN-NY-compliant incident response plan addresses four distinct phases of incident management and three distinct notification obligations. Getting all seven components right is what distinguishes an acceptable plan from a deficient one.
Phase 1: Detection and Initial Assessment (0–4 Hours)
The plan must specify:
How incidents are detected. What monitoring tools are in place? Who receives alerts? What constitutes an incident versus a routine event? For a home health agency using a managed security provider like ShieldForce, the 24/7 SOC is the detection mechanism. The plan should name the detection capability and specify how it alerts the agency.
Who is notified first. The designated incident response coordinator — named, not just titled. For most home health agencies this is the compliance officer or executive director. The plan should include a backup if the primary contact is unavailable.
Initial assessment criteria. How does the first responder determine whether this is a real incident or a false alarm? What questions does the assessment answer: What systems are affected? Is access to SHIN-NY data possible? Is the incident contained or ongoing?
Phase 2: Containment and Documentation (4–24 Hours)
Containment procedures. What actions are taken to stop the incident from spreading? For a ransomware attack: which systems are isolated? For a credential compromise: which accounts are suspended? For a lost device: when and how is remote wipe initiated? These should be specific, actionable steps — not general principles.
Evidence preservation. Security forensics require preserved evidence. The plan should specify what not to do (don't reimage systems before forensic analysis, don't delete email logs) to ensure the organization can conduct a proper investigation.
Documentation requirements. What is recorded? The incident timeline, systems affected, actions taken, and personnel involved must be documented contemporaneously — this is both a HIPAA requirement and essential for the post-incident report.
Phase 3: Notification (0–72 Hours — Concurrent With Phases 1 and 2)
This is the section your RHIO reviews most carefully. The notification phase must address three separate obligations simultaneously:
RHIO notification (within 24–72 hours): The plan must specify:
- The RHIO contact information (name, email, phone for your specific RHIO)
- What information is included in the initial notification: nature of the incident, systems affected, estimated scope of SHIN-NY data involved, containment status, actions taken
- Who in your organization makes the notification
- The format of notification (most RHIOs have a specific form or email template)