Key Takeaways
-
A phone, voicemail, texting, fax, or routing failure can be a security incident even when no PHI is exposed, so begin the response before you know the full scope.
-
Preserve login history, routing changes, call records, voicemail, fax, messaging logs, and vendor communications before resetting systems or changing configurations.
-
If patients cannot reach you, start continuity steps immediately while another team member preserves evidence and contains the problem.
-
When PHI may be involved, a documented four-factor risk assessment determines whether the event is a reportable breach.
-
Close the loop with a completed timeline, a documented decision and rationale, and corrective actions that reduce the chance of a repeat.
- Key Takeaways
- What Counts as a Healthcare Communications Incident?
- What Should Your Team Do First?
- When Does an Incident Become a Breach Question?
- What Should Happen After Service Is Restored?
- What Should an Incident Response Plan Document?
- How Does RingRx Support Incident Readiness?
- How Do You Put the Plan Into Practice?
When phones, voicemail, texting, fax, or call routing fail, a documented incident response plan helps your team keep patients connected, preserve evidence, and make defensible decisions. This guide is for practice managers, administrators, front-desk leaders, and privacy or security leads who may have to act first.
RingRx created two companion resources for this work. The fillable, two-page Incident Response Flowchart gives your team one sequence to use during training or a live incident. When the Phones Go Silent: Incident Response for Healthcare Communications explains the reasoning behind each step.
What Counts as a Healthcare Communications Incident?
A communications incident is any event that disrupts, compromises, or raises concern about the systems your practice uses to communicate. Examples include a phone outage caused by a cyber event, unusual access to a voicemail portal, unauthorized routing changes, a fax sent to the wrong number, or a text sent to the wrong patient.
Five terms often get confused during an incident:
- Communications disruption: Phones, voicemail, texting, fax, or routing stop working as expected. The cause may be a carrier outage, a misconfiguration, or a cyber event.
- Security incident: Under the HIPAA Security Rule, this includes attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations. See HHS guidance on security incident procedures.
- Suspected PHI exposure: Evidence suggests protected health information may have reached, or been viewed by, someone who should not have it.
- Breach risk assessment: The documented four-factor review your practice completes when PHI may be involved.
- Reportable breach: An impermissible use or disclosure of PHI for which the assessment cannot demonstrate a low probability of compromise.
Not every incident becomes a breach. Waiting for certainty costs time and may cost you evidence. Staff should report the event, preserve available records, and begin the response while the privacy or security lead evaluates what happened.
“You can’t document your way out of an incident if you erase the evidence first.”
From When the Phones Go Silent: Incident Response for Healthcare Communications
What Should Your Team Do First?
Record what is failing, preserve the available evidence, then protect patient access and contain the problem. The Incident Response Flowchart follows this sequence:
- Detect: Record the date, who reported the problem, when it was first noticed, and what is failing: calls, voicemail, text, fax, or routing.
- Preserve before changes: Export admin login history, routing and configuration change history, call detail records for the incident window, voicemail access records, fax send and receive logs, portal access logs, messaging access and export logs, and vendor ticket or support communication history.
- Decision A: Determine whether patient access is affected right now.
- Continue care if access is affected: Enable backup routing or answering coverage, update the voicemail greeting and website with an alternate contact method, and use the approved internal coordination method. On-call routing can help urgent calls continue reaching the right provider.
- Contain: Disable compromised accounts, rotate admin credentials, pause outbound messaging if needed, and simplify routing temporarily.
- Decision B: Determine whether PHI is likely to be involved. If it is, complete the breach risk assessment. If it is not, proceed to documentation.
Access, routing, and delivery logs may be short-lived. If you reset systems or reroute traffic before capturing them, you may erase the timeline needed to explain your decisions.
When patients cannot reach you, assign one person to preserve evidence while another starts continuity steps. These actions may need to happen together.
Use the fillable Incident Response Flowchart during training and live incidents so your team can record the owner, date, tihttps://ringrx.com/wp-content/uploads/2026/10/RingRx-Flowchart-form.pdfme, reporter, actions, and decisions in one place.
When Does an Incident Become a Breach Question?
A security incident and a breach are different events. A disruption, suspicious login, or routing change can require a documented response even when there is no evidence that protected health information was accessed or disclosed.
If PHI may be involved, complete and document the four-factor breach risk assessment: the nature and extent of the PHI, who used or received it, whether it was actually acquired or viewed, and how far the risk has been mitigated. If the assessment cannot demonstrate a low probability that PHI was compromised, the event is presumed to be a breach. Notification timelines start from discovery, not the end of the investigation. Your privacy or security lead and legal counsel should make and document notification decisions. The HHS Breach Notification Rule overview explains these requirements.
Does Every Phone Outage Count as a HIPAA Breach?
No. A HIPAA breach requires an impermissible use or disclosure of PHI. An outage can still be a security incident that needs a documented response. If PHI may be involved, your practice should complete a breach risk assessment.
What Should Happen After Service Is Restored?
Close the loop while the details are fresh. The flowchart moves from assessment into documentation and improvement:
- Finalize the incident timeline and preserve the evidence set.
- List the evidence reviewed and document the four-factor assessment when PHI may have been involved.
- Record the decision and rationale, including whether notification was required.
- Hold a short post-incident review and assign corrective actions.
- Update policies, training, access controls, routing, templates, and the log-review cadence where needed.
What Should an Incident Response Plan Document?
A useful plan should be specific enough for staff to follow without searching for answers during a disruption. At minimum, document:
- Who owns the phone, voicemail, texting, fax, routing, answering-service, and call-center workflows
- Who can contact each vendor and request available records
- Which evidence must be preserved, where it is stored, and any vendor retention limits
- Where PHI may appear, including voicemail, call recordings, fax images, message logs, and call metadata
- How patient calls and urgent messages will be handled during downtime
- Which voicemail greeting and website notice will provide alternate contact information
- Who evaluates potential PHI exposure and escalation requirements
- How decisions, corrective actions, and post-incident improvements will be recorded
The RingRx guide When the Phones Go Silent: Incident Response for Healthcare Communications explains the operational and compliance reasoning behind these steps, including common incidents, continuity planning, audit readiness, and frequent gaps that weaken a response.
For related access, credential, and audit-log issues, review these common VoIP security mistakes.
How Does RingRx Support Incident Readiness?
Your plan, policies, training, and risk assessment remain essential. A communications platform can make the plan easier to carry out. RingRx manages phone, voicemail, fax, text messaging, routing, and audit history in one healthcare-focused communications platform.
Depending on configuration and workflow, RingRx can support readiness through:
- Access controls that limit who can work with patient communications
- Audit history that can help your team reconstruct communication activity
- Routing changes and on-call workflows that help urgent calls reach the right provider
Learn more about RingRx compliance and security.
How Do You Put the Plan Into Practice?
An incident plan is useful only when the team can execute it. Confirm system ownership and vendor contacts, then walk through a realistic scenario with the Incident Response Flowchart. Repeat the exercise after major system, vendor, staffing, or workflow changes, and use lessons from real incidents to improve the plan.
How Often Should a Healthcare Practice Test Its Incident Response Plan?
RingRx recommends a tabletop walkthrough at least once a year and after major changes to systems, vendors, staff, or workflows. Use the Incident Response Flowchart so staff practice the same sequence they will follow during an incident.
Download the Incident Response Flowchart
Give your team one sequence to follow when phones, voicemail, texting, fax, or routing fail. The fillable two-page Incident Response Flowchart walks staff through detection, evidence preservation, patient access, containment, PHI assessment, documentation, and follow-up, with space to record the owner, date, time, and reporter.
Want the reasoning behind each step? Read When the Phones Go Silent: Incident Response for Healthcare Communications.
