Draft a HIPAA breach notification letter and the record behind it
This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
What happened, when it started, when it was discovered and by whom, how it was contained, and what forensics can establish.
Total count, counts by state of residence, and whether minors are included.
What has been done, what is offered to individuals, and what changes prevent recurrence.
The states whose breach and health-privacy laws you want analyzed alongside HIPAA.
Sets whether you produce a patient letter or a report up the chain.
Watch for these throughout
The four-factor analysis is the document OCR asks for first. Write it before the letter and keep it privileged and dated. A determination reconstructed after the fact does not hold up.
State deadlines frequently run shorter than HIPAA's sixty days, and several require separate AG or consumer reporting agency notice on their own clocks. Track each state independently.
Media notice triggers at 500 residents of a single State or jurisdiction, not 500 in total. The model will conflate the two if the per-state counts are not in your inputs.
Do not put PHI or the word "breach" on the envelope or in any window field, and check the return address. A privacy-office return line can itself identify the recipient.
Ransomware and encryption events carry their own OCR interpretive posture. If that is the incident, confirm the current guidance before relying on any rebuttal analysis here.