When PHI is misdirected via email, which action aligns with mandated reporting practices?

• A. Wait to see if there's a complaint before reporting.
• B. Only document the incident in the unit log.
• C. Report to the patient and not to supervisors.
• D. Notify supervisor and privacy/security officer and document the incident, initiating the mandated reporting process.

Answer: (D)

PHI misdirection by email is a security breach that triggers a formal breach response. The best action is to escalate by informing your supervisor and the privacy/security officers and documenting the incident, which starts the mandated reporting process. Involving these roles ensures a proper risk assessment, containment steps, and alignment with your organization’s breach-response procedures. Documentation creates a clear, auditable record of what happened, who was affected, and what actions were taken, which is essential for regulatory reporting and any required notifications to affected individuals and authorities.

Waiting to see if a complaint arises delays response; documenting only in a unit log leaves gaps; and notifying the patient without involving supervisors bypasses the internal process designed to handle breaches efficiently and compliantly.