breach-incident-response

Breach Incident Response

Overview

This skill orchestrates security incident and breach response for USA regulatory obligations:

• HIPAA Breach Notification Rule: 45 CFR §164.400–§164.414 (individual, HHS, media notification timelines)
• HITECH: 60-day notification to individuals; HHS OCR reporting
• State breach laws: variable timelines (many 30–90 days)—California, New York, etc.
• SOC 2 CC7.4/CC7.5: Incident identification, response, recovery, communication

AI-specific incidents include: unredacted ePHI sent to non-BAA LLM, MCP tool exfiltration, deanonymization abuse, compromised agent API keys, and prompt injection leading to data disclosure.

When to Use

Use this skill when:

• Suspected or confirmed unauthorized access/disclosure of ePHI, CHD, or confidential data
• LLM data leakage (raw PHI in model logs, training pipeline, vendor breach notification)
• MCP compromise (rogue tool registration, stolen OAuth tokens)
• Agent credential theft or skill tampering detected
• Preparing breach notification letters, HHS OCR reporting, state AG notifications
• Tabletop exercises for agent/MCP incident scenarios
• Post-incident root cause analysis for SOC 2 and HIPAA documentation

Do not use this skill when:

• Designing preventive audit logs (use audit-logging-integrity)
• General vendor risk questionnaires (use vendor-third-party-risk)
• Non-security operational outages without data impact (use availability runbooks)

Core Process

Execute steps in order. Contain first—do not delay containment for documentation.

Step 1: Detection and classification

1. Triage alert source: SIEM, CCM, user report, vendor notification, red team.
2. Classify incident type:
   • Security incident (attempted access, no confirmed disclosure)
   • Breach (acquisition/access/disclosure of unsecured PHI per §164.402 definitions)
   • PCI incident (CHD/SAD suspected compromise)
3. Assign severity and incident commander.
4. Start immutable incident timeline (UTC timestamps, actor actions).