healthcare data breach — quick-start

checklist

1. identify the affected system(s) — EHR, billing platform, imaging archive, or messaging — before declaring scope to legal.
2. pull access logs for the affected system for 60 days back — patient record access events, query logs, bulk exports.
3. export audit logs for any account that accessed records outside their normal patient population or role.
4. check for bulk exports or data downloads from the EHR or data warehouse during the exposure window.
5. identify the first anomalous access event — this establishes the breach start date for HIPAA §164.402 notification timelines.
6. preserve system logs on read-only media before any patching, migration, or auto-purge runs.
7. pull identity provider logs for service accounts and admin accounts with EHR access.
8. engage privacy counsel and compliance before notifying HHS OCR or patients — notification timelines differ by breach type.
9. note the count of affected individuals, their PHI categories (demographics, diagnoses, financials), and whether any is SSN or payment card data.
10. begin the primary tool path below — EHR audit log analyzer and PHI exposure classifier.

primary tools

1. 01dicom medical imaging metadata forensic analyzerdrop dicom files · parse metadata tags · extract patient equipment data · detect anonymization failures · runs locally
2. 02microsoft access database forensic analyzerdrop mdb or accdb files · parse jet database structure · extract tables · recover deleted records · vba macro scan · runs locally
3. 03office365 audit log analyzerdrop m365 unified audit log json or csv · flag inbox forward rules · mailbox forwarding · bulk downloads · global admin role adds · high-scope consent · audit log disabled · runs locally
4. 04microsoft 365 unified audit log analyzerdrop m365 unified audit log csv or json export · parse all audit events across exchange sharepoint teams onedrive and azure ad · surface suspicious operations privilege changes and data access events · reconstruct user activity timeline · runs locally
5. 05windows event log gap analyzerdrop multiple evtx · merged timeline · logging gaps · clearing events · ransomware prep chains · service persistence hints · runs locally
6. 06log ingestion gap and silent host detectordrop siem export or event log collector export · identify machines that stopped sending logs · calculate expected vs actual log volume per host · detect hosts that went dark · flag suspicious silences · runs locally
7. 07log file authenticity and integrity scorerdrop any log file · verify internal consistency · line endings · timestamps · detect log injection · fabrication indicators · authenticity score · runs locally
8. 08chain of custody gap detectorpaste custody log csv · time gaps over threshold · missing signatures · export findings csv · runs locally

go deeper