In the event of a misdirected email containing a patient's PHI, what is the first action you should take?

• A. Delete the email without reporting.
• B. Contact the patient to inform them.
• C. Notify your supervisor and the privacy/security officer and document the incident, initiating the mandated reporting process.
• D. Ignore it since it's already sent.

Answer: (C)

When PHI is exposed through a misdirected email, you’re dealing with a potential breach and need to trigger the formal response process. The first action is to escalate to the supervisor and the privacy/security officer and document what happened, starting the mandated reporting process. This puts the right people in charge to contain the exposure, assess the risk, and determine whether patient notification or regulator reporting is required. By documenting the incident now, you create an clear record of what occurred, who was involved, and what steps were taken, which is essential for compliance and future prevention.

Deleting the email without reporting leaves the organization without a trace and bypasses the required breach response. Reaching out to the patient on your own can interfere with the official assessment and timing of notifications. Ignoring the incident is not acceptable and violates patient privacy policies and legal obligations. Promptly involving the supervisor and privacy/security officer ensures a proper, compliant response.