incident-response-breach-notification

Run this skill against your backend and frontend source trees to grep for breach notification templates, breach log models, incident response documentation, and security contacts. It maps each finding to 45 CFR 164.404-408 requirements in a compliance checklist.

Individuals must be notified within 60 calendar days of discovery. Breaches affecting 500 or more individuals require concurrent HHS notification and media notice, while smaller breaches are reported to HHS annually within 60 days of calendar year end.

Yes, PHI encrypted per NIST standards (AES-128 or stronger) is considered secured PHI under 45 CFR 164.402(2), so a breach of encrypted data does not require notification. This makes field-level encryption a strong safe harbor.

The 45 CFR 164.402 test evaluates the nature and extent of PHI involved, the unauthorized person who accessed it, whether PHI was actually acquired or viewed, and the extent of risk mitigation. Unless all four factors show low probability of compromise, the incident is a reportable breach.

Yes, it supports --simulate for tabletop breach exercises, --audit-only for readiness checks, and --generate-plan for creating an incident response plan. Each mode uses the same regulatory framework but produces different outputs.

The audit only detects what exists in the source code and documentation; it cannot verify operational procedures, staff training, or actual notification delivery. It also notes the platform currently lacks a Breach or Incident model, so breach documentation must be maintained externally.