| Course | HI135 Legal Aspects of Health Information |
|---|---|
| Unit | Unit 8 |
| Paper type | Breach notification memo |
| Length | About 850 words, 6 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | BS in Health Information Management |
| Updated | October 2026 |
Free sample paper for HI135 Unit 8
A Leased Copier Went Back With Its Memory Full: A Unit 8 Breach Notification Memo Counting Sixty Days From Discovery for 1,140 Patients Whose Scanned Intake Forms Sat on an Unwiped Hard Drive
[Student Name]
Purdue University Global
HI135: Legal Aspects of Health Information
Unit 8 Breach Notification Memo
[Instructor Name]
[Date]
The clinic, the leasing company and the counts are composite; the breach rule, its factors and deadlines, and the sources cited are real.
To, From, Date, Subject
To: clinic administrator. From: privacy officer. Date: July 18. Subject: unwiped copier drive and notification decision.
Summary
This incident is a reportable breach. We cannot show that compromise of these records is unlikely. Notices must reach the 1,140 affected patients, the Secretary of Health and Human Services and prominent media in our state no later than September 13, sixty calendar days after discovery on July 15. I recommend mailing patient notices by August 15.
What Happened
When our lease ran out in March, the copier-scanner went back to the leasing company. Inside it sat a hard drive that stores an image of every page scanned. Nobody at the clinic arranged for the drive to be wiped, and the lease did not require it. The leasing company refurbished the machine and sold it in May to a small accounting firm. On July 15, a leasing company technician servicing the machine at the accounting firm noticed patient images in the drive's stored jobs, removed the drive and called us the same day. A forensic review found about 2,300 scanned pages from January 2022 to March, belonging to 1,140 patients: names, dates of birth, addresses, insurance member numbers and, on referral letters, diagnoses for 212 of them.
Discovery Date
Discovery is the first day anyone in the clinic knew of the breach, or would have known by exercising ordinary care (45 C.F.R. § 164.404, 2024). We learned on July 15. One could argue we should have known in March, when the copier left; I recommend we treat July 15 as discovery, since nothing in March gave anyone reason to know the drive held images, while acknowledging in our documentation that the risk was foreseeable.
Risk Assessment
The rule starts from a presumption of breach, which the clinic can overcome only with a documented four-factor assessment showing compromise is unlikely (45 C.F.R. § 164.402, 2024).
1. Nature and extent of the information. Names with dates of birth, addresses and insurance member numbers can be used for medical identity theft; diagnoses add sensitivity for 212 patients. This factor weighs heavily toward compromise.
2. The unauthorized person. An accounting firm with no reason to seek health information and its own confidentiality duties. This weighs somewhat toward low risk.
3. Whether anyone actually opened or took the images. The firm's owner signed a statement that no one opened stored jobs, but the copier's interface allowed anyone at the machine to browse them for two months, and the forensic review could not confirm or rule out viewing. Unknown, which cannot support a low-probability finding.
4. Mitigation. The drive was recovered within hours of discovery and is now in our custody. This helps but comes after two months of exposure.
Conclusion: taken together, the factors do not demonstrate a low probability of compromise. Notification is required.
A signed statement that nobody looked is not the same as evidence that nobody could have looked, and the rule asks for the second.
Notification Plan
Patients: a first-class letter to each of the 1,140, covering the event, the kinds of information on the drive, steps patients can take, our own response and a way to reach us, with a toll-free number (45 C.F.R. § 164.404, 2024). Outside deadline September 13; target August 15. Eleven patients have died; their notices go to next of kin or personal representatives where addresses are known. Media: 1,090 of the affected patients live in this state, well past the 500 that triggers press notice, so a statement goes to the major outlets serving the state by the same deadline (45 C.F.R. § 164.406, 2024). Secretary: because 500 or more individuals are affected, notice through the federal breach portal at the same time as patient notices, since only breaches touching fewer than 500 people may be reported after the calendar year closes (45 C.F.R. § 164.408, 2024). Name on every notice: the clinic, as the covered entity. The leasing company's role is described factually and its cooperation acknowledged. Additional step: offer twelve months of credit and medical identity monitoring to all affected patients. It is not required by the rule but responds to the insurance numbers in the files.
Corrective Actions
Inventory every device that stores images or files, including copiers, scanners and fax machines. Add a drive return or certified wipe clause to every equipment lease. Assign the practice manager to sign off on any device leaving the building. A federal settlement in 2013 involving a health plan's returned photocopiers shows that regulators treat this exact failure as a lapse in risk analysis and device controls (U.S. Department of Health and Human Services [HHS], 2013).
References
45 C.F.R. § 164.402 (2024). https://www.ecfr.gov/current/title-45/section-164.402
45 C.F.R. § 164.404 (2024). https://www.ecfr.gov/current/title-45/section-164.404
45 C.F.R. § 164.406 (2024). https://www.ecfr.gov/current/title-45/section-164.406
45 C.F.R. § 164.408 (2024). https://www.ecfr.gov/current/title-45/section-164.408
U.S. Department of Health and Human Services. (2013, August 14). HHS settles with health plan in photocopier breach case [Press release].
Reading the HI 135 Unit 8 instructions
Unit 8 usually asks you to write a memo deciding whether an incident is a reportable breach and planning notification. State the conclusion first. Describe the incident in chronological order and identify the discovery date carefully, since it starts the clock. Work through the federal four-factor risk assessment and reach a conclusion rather than listing factors. If notification is required, set out each audience, the method, the outside deadline and the name on the notice, including media and federal notice when thresholds are met. Address state law briefly where the scenario names a state. Close with corrective actions. Memo format with to, from, date and subject lines is standard, usually two to three pages.
Inside the HI135 Unit 8 example
The memo opens with header lines and a summary giving the decision, the deadline and a recommended mailing date. The incident account covers the lease return, the resale, the technician's discovery and the forensic count. A discovery section explains the date chosen and acknowledges the foreseeable risk. Four numbered factors follow with a conclusion, a highlighted line on signed statements and a margin note. The notification plan covers patients, deceased patients' representatives, media and the Secretary, each with deadline and authority, plus optional monitoring. Corrective actions and a reference to a federal settlement over returned copiers close the memo. Each audience's deadline is counted from the same discovery date.
HI135 Unit 8 rubric: what earns full points
Breach memos in HI 135 are typically graded on accurate application of the notification rules. Points go to a correct discovery date, a genuine four-factor assessment with a reasoned conclusion and complete notification planning by audience. Credit rises for correct thresholds and deadlines for media and federal notice, and for naming who signs. Instructors value a summary that states the decision first and corrective actions that address the root cause. Clear, factual writing without speculation adds marks. Accurate citations complete the rubric. Memos that list factors without concluding, or that count deadlines from the incident rather than discovery, usually lose points. Instructors also look for corrective actions aimed at the cause, not only at the notices.
HI135 Unit 8 help from the desk
The most frequent error is counting the sixty days from when the incident happened rather than from discovery. Another is treating a recipient's promise as proof that information was not viewed. Students also overlook press notice once a breach reaches over 500 people in one state, or treat a large breach as if it could wait for the year-end federal report. Do not blame the vendor in patient notices; the covered entity notifies. Keep the incident account factual. Send us your incident scenario and we will write the memo with the assessment, deadlines and notification plan. Finally, put the decision and the deadline in the first paragraph.
Get an HI135 Unit 8 example written to your instructions
Breach scenarios differ in headcount, data type and state, and each of those moves the answer. Send your Unit 8 facts, the instructions and the rubric; the memo returned in 24-48h fits its risk finding and notice plan to those facts alone. There is nothing to pay for a first sample. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More HI135 papers and BS in Health Information Management samples
- HI135 Unit 1: Discussion Board Post
- HI135 Unit 2: Authorization Review
- HI135 Unit 3: Release of Information Case
- HI135 Unit 4: Privacy Notice Comparison
- HI135 Unit 5: Retention Schedule
- HI135 Unit 6: Seminar Reflection
- HI135 Unit 7: Amendment Response Letter
- HI135 Unit 9: Disclosure Log Entry
- HI135 Unit 10: Privacy Policy Draft
HI135 Unit 8 questions, answered
Is every privacy incident a reportable breach?
No. Under the federal rule an impermissible disclosure is presumed a breach unless a documented risk assessment shows a low probability that the information was compromised, and some situations fall under narrow exceptions. The memo here works through that assessment on its facts and concludes notice is needed. With different facts, the same memo structure can reach the opposite conclusion and document why.
Does the memo need to address state law?
Briefly, yes. Many states have their own breach statutes with different triggers, deadlines or agencies to notify, and the stricter requirement can apply alongside the federal one. The example names the need to check the state statute and assigns it to the privacy officer rather than guessing at its content. Where your facts name a specific state, apply its rule by citation.
Who actually signs the patient notices?
Usually the covered entity, through its privacy officer or a designated executive, even when a vendor caused the incident. The example puts a named signer beside each notice so nothing is left to whoever happens to be available. Where a business associate made the error, the memo notes that the associate reports to the facility, which usually handles the patient notices itself.
Where can I find a free HI135 Unit 8 sample paper?
The complete Unit 8 memo on the copier hard drive breach, with the risk assessment and notification plan, is open on this page.
When does the sixty-day notification clock start?
On the day the breach is discovered, meaning the first day it was known to the covered entity or would have been known with reasonable care.