Incident Report Template: Jira for Healthcare
Healthcare incidents have regulatory reporting obligations that other industries do not face. A data breach involving Protected Health Information (PHI) requires assessment under the HIPAA Breach Notification Rule, potential notification to HHS Office for Civil Rights (OCR), and individual notification to affected patients within 60 days.
This Jira template structures incident reports around HIPAA breach assessment and regulatory notification timelines.
Template sections
5 sections covering the complete incident report workflow.
PHI Exposure Assessment
Quantify exactly what PHI was exposed, to whom, and for how long. HIPAA requires breach notification based on the nature and extent of PHI involved. Document every PHI data element exposed using the HIPAA 18 identifiers list. Include the number of individuals affected because breaches affecting 500+ individuals require notification to OCR and media.
Incident: API endpoint returned patient data without authentication for 4 hours (2 AM - 6 AM EST). PHI exposed: patient name, date of birth, medical record number, diagnosis codes (ICD-10). Individuals affected: 847 patient records accessible via the endpoint. Access logs show 12 unique IP addresses accessed the endpoint during the window. No evidence of bulk data exfiltration (no requests exceeded 10 records).
Tips
- List every PHI data element exposed using the HIPAA 18 identifiers checklist
- Count affected individuals precisely - this determines notification requirements
- Preserve access logs immediately as forensic evidence
- Document both what was accessible and what was actually accessed
HIPAA Breach Risk Assessment
Perform the four-factor breach risk assessment required by HIPAA to determine notification obligation: (1) nature and extent of PHI involved, (2) unauthorized person who used or accessed the PHI, (3) whether PHI was actually acquired or viewed, and (4) extent of risk mitigation. Document each factor with evidence. If you cannot demonstrate low probability of compromise, notification is required.
Factor 1: PHI includes diagnosis codes (sensitive), but no SSN, financial, or substance abuse data. Risk: Medium. Factor 2: 12 IP addresses, 3 identified as search engine crawlers (excluded), 9 unidentified. Risk: High (unknown actors). Factor 3: Access logs show page views but no evidence of data extraction (no CSV downloads, no sequential record access). Risk: Medium. Factor 4: Endpoint secured within 4 hours, exposed data not cached by search engines (robots.txt blocked, confirmed by Google cache check). Mitigation: Medium. Conclusion: cannot demonstrate low probability of compromise. Notification required.
Tips
- Document all four HIPAA breach risk assessment factors with specific evidence
- Err on the side of notification if any factor cannot be conclusively assessed
- Include forensic evidence for each factor (logs, screenshots, third-party verification)
- Have legal counsel review the risk assessment before finalizing notification decision
Notification Requirements and Timeline
If breach notification is required, document the notification timeline: individual notification within 60 days of discovery, OCR notification (within 60 days for 500+ individuals, annual log for fewer), and media notification if 500+ individuals in a single state. Include notification templates and the approval chain. Missing notification deadlines creates additional HIPAA violations.
Notification plan: 847 individuals affected (>500 threshold). OCR notification: submit via HHS breach portal within 60 days (deadline: October 15). Individual notification: mailed letters to all 847 patients within 45 days (allows 15-day buffer). Media notification: press release to major media in states where affected patients reside. Substitute notice: website posting for 90 days for individuals with outdated addresses. Toll-free number for patient inquiries: active for 90 days.
Tips
- Calculate the 60-day notification deadline immediately upon breach discovery
- Build 15 days of buffer into the individual notification timeline for production and mailing
- Prepare media notification template simultaneously with individual notification
- Set up a toll-free inquiry number before notifications are sent
Root Cause and Remediation
Document the technical root cause, the organizational root cause (why controls did not prevent this), and the remediation plan. HIPAA requires reasonable safeguards, so your remediation must demonstrate that you have strengthened controls to prevent recurrence. Include the remediation timeline and verification steps.
Technical root cause: API authentication middleware was bypassed by a deployment configuration error. The staging configuration (auth disabled) was promoted to production. Organizational root cause: no pre-deployment checklist verifying authentication is enabled. No automated test validating that unauthenticated requests to PHI endpoints return 401. Remediation: (1) fix configuration immediately (done), (2) add automated auth verification test to CI/CD (1 week), (3) add pre-deployment security checklist to Jira workflow (1 week), (4) quarterly PHI endpoint access audit (ongoing).
Tips
- Identify both technical and organizational root causes
- Remediation must demonstrate strengthened controls for HIPAA compliance
- Include automated prevention measures, not just process changes
- Schedule quarterly verification that remediation measures remain effective
Incident Documentation for Audit
Maintain comprehensive incident documentation for potential HHS audit. HIPAA requires covered entities to maintain breach documentation for 6 years. Create a Jira epic containing the incident timeline, risk assessment, notification evidence, and remediation documentation. This epic is the audit-ready package.
Incident documentation package (Jira epic HEALTH-2847): (1) Incident timeline with timestamps and evidence, (2) Four-factor breach risk assessment with supporting logs, (3) Notification decision memo signed by Privacy Officer, (4) OCR breach report submission confirmation, (5) Individual notification letter template and mailing confirmation, (6) Remediation plan with completion evidence, (7) Post-remediation verification results. Retention: 6 years minimum, stored in compliance document management system.
Tips
- Create a Jira epic template for incidents containing all required documentation sections
- Assign the Privacy Officer as the epic owner for accountability
- Include submission confirmations and mailing evidence as Jira attachments
- Set a 6-year retention reminder on the epic for HIPAA compliance
Copy-paste template
# Incident Report — Healthcare (Jira) ## Incident Summary - **Date discovered:** [Date/Time] - **Duration:** [Hours] - **PHI exposed:** [Data elements] - **Individuals affected:** [Count] ## HIPAA Breach Risk Assessment | Factor | Assessment | Evidence | Risk | |---|---|---|---| | Nature of PHI | [Assessment] | [Evidence] | [Low/Med/High] | | Unauthorized person | [Assessment] | [Evidence] | [Low/Med/High] | | Actually acquired/viewed | [Assessment] | [Evidence] | [Low/Med/High] | | Risk mitigation | [Assessment] | [Evidence] | [Low/Med/High] | ## Notification Plan - **OCR:** [Required/Not Required] — Deadline: [Date] - **Individuals:** [Count] — Method: [Mail/Email] — Deadline: [Date] - **Media:** [Required/Not Required] ## Remediation | Action | Owner | Status | Due | |---|---|---|---| | [Action] | [Name] | [Status] | [Date] |
Frequently asked questions
Generate instead of filling in templates
Connect your tools, and Vantage generates the content using real product data. Free to start.
Free to start. No credit card required.