Prompt reporting and structured response help limit risk to users, healthcare organizations, and protected information.
1Reporting
Users and customers should promptly report suspected unauthorized access, lost credentials, misdirected information, malware, or unusual account activity.
2Triage and Containment
SBARAlerts should validate the report, preserve relevant evidence, restrict affected credentials or systems, and contain ongoing risk.
3Assessment
The investigation should evaluate information involved, persons affected, acquisition or viewing risk, mitigation, contractual duties, and applicable notification requirements.
4Notification
Notifications to customers or authorities will be made according to applicable law and contract. Timing and content may depend on the role of SBARAlerts and the affected healthcare organization.
5Recovery and Improvement
After containment, SBARAlerts should restore secure operations, document actions, identify root causes, and implement corrective measures.