The First 30 Minutes After a Medical Practice Data Breach

A staff member clicks a link. A patient file goes to the wrong number. A laptop with patient data goes missing. The clock starts. What happens in the next 30 minutes determines whether this becomes a contained incident or a catastrophe.

Most practices have no plan for those 30 minutes. This article outlines what should happen — and why building it in advance matters.

Minutes 0–5: Stop and contain

The instinct is to panic, to delete everything, to start calling everyone. That's the worst response. The first five minutes should be calm, deliberate containment:

• Disconnect the affected device from the network — don't turn it off, just remove it from Wi-Fi or unplug the cable. Preserving evidence matters.
• Don't delete files or emails. They may be the only record of what happened and how.
• Identify one person to lead the response — usually the Information Officer or practice manager. Everyone else stops and waits for direction.

Minutes 5–15: Assess and escalate

Now you need to understand what actually happened — and start the formal clock:

• What information was involved? Patient names and IDs? Clinical records? Banking details? The sensitivity of the data determines the severity.
• How many people are affected? One patient or the entire database?
• Is this a notifiable incident under POPIA? If personal information has been accessed or acquired by an unauthorised party, it likely is — and there are timelines.
• Contact your Information Officer. If you don't know who that is, that's the first problem to fix.

Minutes 15–30: Communicate

This is where most practices get it wrong — by saying too much, too little, or the wrong thing to the wrong people:

• Don't contact affected patients yet — not until you know what to tell them. A panicked, incomplete notification creates more harm than a brief, accurate one 24 hours later.
• Do contact your IT provider if you have one, and your cybersecurity consultant if you have one.
• Do document everything you've done so far. Time-stamped notes are your evidence of reasonable response.
• Don't post about it on social media. Don't tell staff who don't need to know.

After the first 30 minutes

The acute phase is over. Now the structured response begins: formal regulator notification if required, affected-patient communication, forensic investigation if needed, and a review of what went wrong and how to prevent it.

But none of that works if the first 30 minutes were chaos. A calm, rehearsed start makes everything that follows manageable.

The one thing to do today

If you do nothing else after reading this, do one thing: name your incident lead. Write it down. Tell your staff. When something happens, that person takes charge of the first 30 minutes. Everything else can be built from there.