Security — How do I know if our practice has experienced a data breach?

Signs include unusual system behavior, unexpected account lockouts, staff receiving strange emails, or patients reporting suspicious contact. Under HIPAA, you are required to report a confirmed breach within 72 hours of discovery. If you suspect anything, contact your IT provider immediately — do not investigate on your own.