Responding to Potential Data Disclosure: A Member's Guide

Immediate Responsibilities Upon Suspected Disclosure

1. Inform your Security Officer immediately.
2. Document all details: what, when, how discovered, affected systems/data, actions taken.
3. Preserve & Secure affected equipment/media (do not alter, delete, or investigate independently).
4. Contact External Resources (forensics, legal, law enforcement) if authorized or directed by leadership.

Why This Matters

Rapid, structured response limits harm, preserves evidence for investigation, and ensures compliance with legal/regulatory obligations (HIPAA, GDPR, state breach laws).

Do Not

• Attempt to "fix" the breach yourself.
• Discuss details with unauthorized personnel.
• Delay reporting.