HI575 Unit 7 Incident Response Plan Example

Course	HI575 Protection of Health Information
Unit	Unit 7
Paper type	Incident response plan
Length	About 870 words, 6 pages double-spaced
Format	APA 7 student paper
School	Purdue University Global
Program	MS in Health Informatics
Updated	October 2026

Free sample paper for HI575 Unit 7

Nine Days of Silent Forwarding: A Unit 7 Incident Response Plan Applied From the First Alert to the Notification Decision

[Student Name]

Purdue University Global

HI575: Protection of Health Information

Unit 7 Incident Response Plan

[Instructor Name]

[Date]

Tollbridge Orthopedic Group, its staff, the incident and every count are composite; the regulations and sources cited are real.

What this part is doingPlacing the standing plan before the incident shows which decisions were made calmly in advance and which had to be made under pressure.

Part One: The Standing Plan

Incident response team, five roles:

1. Incident lead: privacy and security officer, who owns the response and the decision log.

2. Technical lead: IT contractor's on-call engineer, who contains and preserves.

3. Clinical and operations lead: practice administrator, who decides on any disruption to clinics.

4. Communications lead: office manager, who drafts staff, patient and media messages.

5. Legal adviser: outside counsel, consulted on notification and law enforcement.

Severity levels, defined by data involved and operations affected:

1. Level 1: no patient information involved, no disruption.

2. Level 2: limited patient information, or one clinic disrupted for under a day.

3. Level 3: patient information for more than 100 people, or practice-wide disruption.

A contact sheet with every team member's phone number is kept on paper in the administrator's office and the incident lead's home, as well as online, because an incident may take email down. A decision log template records each decision, who made it, when and on what information.

The structure follows the federal incident handling guide's phases of preparation, detection and analysis, containment and recovery, and post-incident activity (Cichonski et al., 2012), adapted to a practice with no internal security staff.

Part Two: The Mailbox Incident

Detect

Day 9, 10:14: the email provider sent a sign-in alert for the billing specialist's account from an unfamiliar country. The IT contractor's engineer saw it at 10:40 and called the incident lead at 10:46.

Contain

The engineer acted in this order, each step logged with its time:

1. 10:52 ended all active sessions for the account.

2. 10:55 reset the password and required multifactor setup at next sign-in.

3. 11:02 exported the mailbox rules, finding a rule created on day 0 that forwarded every incoming message to an outside address.

4. 11:10 removed the rule after the export was saved.

5. 11:25 blocked automatic forwarding to outside addresses for the whole domain.

6. 12:40 confirmed no other mailbox had a similar rule.

The forwarding rule was exported before it was deleted, because removing it first would have destroyed the only record of what had been sent and when.

What this part is doingWriting containment as timed actions, with preservation beside it, is what lets an auditor reconstruct the response and confirms evidence was kept.

Preserve

The exported rule, the provider's sign-in logs for days 0 through 9 and a copy of the mailbox were saved to a restricted folder with a record of who collected them and when.

Assess

The provider's logs showed 412 messages forwarded between day 0 and day 9. The incident lead and the billing manager reviewed each one. Sixty-three carried attachments with patient information: remittance files, claim attachments and two workers' compensation spreadsheets. Together they named 1,180 patients, with names, dates of service, procedure codes and, in 214 cases, insurance member numbers. No Social Security numbers were included.

Federal rules treat any disclosure the Privacy Rule does not allow as a breach unless shown otherwise, and Tollbridge could overcome that only by weighing four factors and showing the chance of compromise is small (45 C.F.R. § 164.402, 2024):

1. What was exposed and how much: patient names with visit dates, procedure codes and member numbers, enough to identify patients and support insurance fraud.

2. The unauthorized person: an unknown outside address, presumed malicious.

3. Did anyone actually receive or open it? the forwarding delivered every message to the outside address, so acquisition is assumed.

4. Extent of mitigation: the address could not be contacted and no assurance of destruction was possible.

None of the four factors pulls the risk down, so the presumption stands and the event is treated as a breach.

Decide

Day 11: the incident lead, administrator and counsel met and recorded three decisions: notify all 1,180 patients; report to HHS; notify media, since more than 500 residents of the practice's state are affected.

Notify

Letters to patients go by first-class mail promptly, inside a 60-day outer limit counted from discovery, and each explains the event, the kinds of information taken, steps the patient can take, the practice's response and a contact number (45 C.F.R. § 164.404, 2024). Day 9 is the date of discovery. Notices were mailed on day 24, with an offer of credit monitoring for the 214 patients whose member numbers were exposed. Because more than 500 residents of one state were affected, notice went to prominent media outlets serving the area within the same period (45 C.F.R. § 164.406, 2024), and HHS was notified through its breach portal at the same time (45 C.F.R. § 164.408, 2024).

Review

Day 30: a review meeting recorded three lessons. Multifactor sign-in, already proposed in the technical safeguards brief, would likely have prevented the takeover. The matrix had rated silent forwarding as moderate; it is now high until multifactor sign-in is complete. And the alert was seen twenty-six minutes after it fired, which is acceptable, but only because the engineer happened to be at a desk; alerts now go to a phone.

What this part is doingEnding with what the incident changed in the earlier risk ratings shows the plan feeding back into the assessment rather than closing as a one-time event.

References

45 C.F.R. § 164.402 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402

45 C.F.R. § 164.404 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404

45 C.F.R. § 164.406 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.406

45 C.F.R. § 164.408 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.408

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST Special Publication 800-61, Revision 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r2

What the HI575 Unit 7 assignment asks for

The seventh unit typically asks for an incident response plan and its application to a scenario. Expect a standing plan with roles, severity levels and communication arrangements, then a walk through a specific incident from detection to post-incident review. Seven pages in two parts is common. Assign roles before the incident so ownership is clear in the first hour. Write containment as specific actions with times, and preserve evidence before deleting anything. Apply the breach notification rule's four-factor assessment explicitly. State the notification decisions, deadlines and audiences, including HHS and media where thresholds are met. End with lessons that change earlier risk ratings or controls.

How this HI575 Unit 7 example is built

Part one lists five roles, three severity levels, a paper contact sheet and a decision log, linked to the federal incident handling guide. Part two follows the mailbox event. Detection records the sign-in alert and response time. Containment lists six timed actions, and the highlighted sentence explains exporting the forwarding rule before removing it. Preservation records what evidence was saved. The assessment counts 412 forwarded messages and 63 attachments naming 1,180 patients, then works through the four breach factors. The decision section records notification of patients, HHS and media. A notification section cites the deadlines and contents, and a review section raises the forwarding risk and reroutes alerts.

Reading the HI575 Unit 7 grading rubric

Incident response plans are commonly graded on the completeness of the standing plan, the quality of the applied response, correct application of breach notification rules and the post-incident review. The applied response and the notification analysis usually carry the most points. Graders look for timed containment steps, evidence preservation and an explicit four-factor assessment that reaches a supported conclusion. Notification is judged on correct deadlines, audiences and contents. The standing plan earns credit for named roles and severity definitions. A review that feeds lessons back into the risk assessment adds points. Citations to the breach rule sections finish the marks. Plans that stop at containment, or declare no breach without a documented assessment, tend to lose points. A decision log that records who decided what and when is often worth separate credit, since regulators ask for exactly that record.

HI575 Unit 7 help from the desk

The most common weakness in this unit is a plan that lists phases from a template without applying them to the event. Another is deleting malicious settings before preserving them. Some students skip the four-factor assessment or treat it as optional. Notification deadlines are frequently misstated, and the media threshold is often overlooked. Reviews that conclude everything went well miss the point. Where your scenario is a lost laptop, a misdirected mailing or ransomware instead, give us the incident facts and we will run the same plan through that event step by step. Another slip is counting the notification deadline from the day the investigation ended rather than from discovery.

Get an HI575 Unit 7 example written to your instructions

Incident prompts differ mostly in the event they describe. Pass along yours, with the Unit 7 instructions and the rubric, and a custom plan will order the response to that event, from containing it through deciding who must be told, with roles and times filled in. The first sample is free, and turnaround is 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

More HI575 papers and MS in Health Informatics samples

HI575 Unit 7 questions, answered

When does the breach notification clock start?

At discovery, which the rule treats as the first day the incident is known or would have been known with reasonable diligence. The example counts from the day the sign-in alert was read, and notes that nine unnoticed days could be argued either way. Stating the date chosen and the reason gives a grader something to check rather than an assumed deadline.

Does every incident involving patient data require notification?

No. The rule treats an impermissible use or disclosure as a breach by default, and only a written risk assessment finding little probability of compromise rebuts that presumption. The example applies that assessment to each message group and reaches different conclusions for remittance files and routine scheduling notes. What graders want to see is the reasoning recorded, whatever the conclusion turns out to be.

How much should the plan say about the attack itself?

Enough to explain the containment and the assessment, and no more. The example states that credentials were phished and a forwarding rule was added, because those facts decide what to remove and what was exposed. Step-by-step technique adds nothing an incident response grader looks for, and it drags the paper toward method when the rubric is scoring decisions.

Where can I find a free HI575 Unit 7 sample paper?

The full Unit 7 plan is available on this page, applying a standing plan to nine days of silent email forwarding from alert to notification.

Why export a malicious forwarding rule before deleting it?

Deleting it first destroys the record of what was forwarded and when, which the breach assessment needs in order to count affected patients.