Attachment I - OMIS Procedure IM-01 - Incident Management Plan.pdf

State of West Virginia Departments of Health, Health Facilities, and Human Services

Office of Shared Administration Office of Management Information Services OMIS Procedure

IM-01 – Incident Management Plan

Revised: January 26, 2026

Overview

The mandate for this Incident Management Plan comes from section 3.4.9 of #OP-30 Incident Reporting and Response, which states that, "The OMIS ISO will collaborate and cooperate with federal, state, and local authorities, and with WVOT to implement an incident management plan and to expedite mitigation strategies."

This plan is a starting point for the Incident Response Team and the Departments’ subject matter experts (SMEs) to ensure the following:

● A rapid and coordinated response when significant operational disruptions occur, so that continuity strategies can be invoked quickly and effectively.

● Specific key stakeholders are fully always informed of the situation.

● Business continuity and recovery efforts are coordinated across Departments, the WVOT, and applicable system owners.

The plan will enable the efficient and effective management of Information Security and Privacy incidents by establishing a structure for the reporting and management of such incidents. It will help to determine what steps should be taken to make certain that once identified, the incident has been reported, documented, analyzed, contained, eradicated, thoroughly investigated, all systems are recovered, and normal business is restored. After these steps occur, the Incident Response Team and all other SMEs will meet to review and assess any damage.

The plan is the initial part of a greater response environment documented by the notebook it is part of.

When an incident occurs, begin with the plan, then incorporate the tools, policies, and procedures in the notebook in response to the incident.

OMIS Incident Management Plan – v.2.4 - Page 1 of 20

Attachment I

Office of Shared Administration Office of Management Information Services OMIS Procedure

IM-01 – Incident Management Plan

Revised: January 26, 2026

When using documents in the notebook, especially (1) the Post Incident Response Assessment, (2) the

Risk of Compromise Assessment (ROCA) – HIPAA, (3) the Risk of Harm Assessment (ROHA) – Non-HIPAA, and (4) the Incident Response Event Checklist, be sure to download the latest versions of these documents from the WV State Privacy Office website. These documents can be found online at https://brim.wv.gov/privacy/Pages/default.aspx.

The best way to deal with an incident is to be prepared before it happens. This plan requires the

Incident Response Team meet at least once a year and walk through a sample incident. A good way to start this process is to pull an incident scenario out of a hat and follow it from beginning to end.

This plan is a living document. As new technologies emerge, the members of the Incident Response

Team are encouraged to update the plan as needed to fit current scenarios. New technologies might include advances in hardware, software, external threats from hackers, etc. If this plan sits still, it will not meet these new challenges.

Outline of the Plan

Before the Incident

1. Maintain a WV Departments of Health (DH), Health Facilities (DHF), Human Services (DoHS), and Office of Shared Administration (OSA) Incident Response Team. Current members will include, but may not be limited to the following:

a. OSA Chief Information Officer or a designee

b. OSA OMIS Director of Operations

c. State Privacy Office, as necessary

d. OMIS Database Administrators, as necessary

e. OMIS Information Security Officer

f. WVOT Security Operations Center & Forensic Investigating Team

OMIS Incident Management Plan – v.2.4 - Page 2 of 20 https://brim.wv.gov/privacy/Pages/default.aspx

Office of Shared Administration

g. Relevant contractors

h. DoH, DHF, and DoHS Legal representatives

2. Meet at least every 365 days to test the effectiveness of the incident response capability for the applicable system using the following tests:

a. Conduct a mock incident and practice response protocols (i.e., tabletop exercises).

b. Use qualitative and quantitative data from testing to:

▪ Determine the effectiveness of incident response processes;

▪ Continuously improve incident response processes; and

▪ Provide accurate and consistent incident response measures and metrics in a reproducible format.

c. Review annually and update (as needed) the Incident Management Plan.

3. Create a Contact List

a. Management is responsible for creating a list of those who should be notified when a suspected or confirmed breach or incident occurs. The list should specify required as well as optional contacts. The list will contain multiple phone numbers, emails, or other methods of contacting each individual or entity, and will include what to do if a person or entity cannot be reached, how often to retry, and what backup plan may exist.

i. The Incident Response manager should be the central point of all communication and only those with a valid need-to-know should be included in communications regarding key incident details, indicators of compromise, adversary tactics, and procedures.

b. The team will update DH, DHF, DoHS, and OSA leadership and stakeholders on the status of an incident as it is being resolved: The incident response preparedness plan must include instructions on how the team will provide feedback and updates to organization and data stakeholders. A designated member of the team will distribute updates no later than once every hour. This will be in a form (e.g., email, text, phone, etc.) agreed

OMIS Incident Management Plan – v.2.4 - Page 3 of 20

Office of Shared Administration upon by all team members. The designated team member should be prepared to receive feedback from leadership and stakeholders and respond to each update. All individuals will follow this communications model so that the incident response team is not overrun by update requests, enabling them to concentrate on investigating the incident.

4. Conduct a Privacy Impact Assessment (PIA) on new or updated systems or software. The PIA is available from the WV State Privacy Office.

5. Periodically conduct a risk analysis, according to section 3.29 of OMIS #0512: Information

Security Policy.

Report the Incident

● When faced with a security incident or an unauthorized disclosure, whether real or perceived, report information security breaches or unauthorized disclosures immediately, or no longer than 15 minutes, after discovery. All security incidents and/or unauthorized disclosures must be reported concurrently to WVOT and OMIS.

Depending on the nature of the incident, it must be reported to the Internal Revenue

Service (IRS), the Social Security Administration (SSA), and/or the Centers for Medicare and Medicaid Services (CMS). See OMIS OP-30, Incident Reporting and Response.

Document the Incident

● Using the Post Incident Response Assessment, available from the WV State

Privacy Office website, document the event in detail. Conduct interviews with all relevant parties.

OMIS Incident Management Plan – v.2.4 - Page 4 of 20 https://www.wvdhhr.org/mis/policies/Information_Security_Policy.pdf https://www.wvdhhr.org/mis/policies/Information_Security_Policy.pdf https://www.wvdhhr.org/mis/policies/Incident_Reporting_and_Response.pdf

Office of Shared Administration

Communications

● Determine if it is necessary to inform the public with a press release. See WV State

Privacy Office procedure - WVEB-P101.1 Response to Unauthorized Disclosures

● Review and Learn from the Incident

Determine what the Departments can learn from the incident. If necessary, consult internal and external experts to understand the nature of the incident.

Update Processes

● If software or system changes are necessary, implement those changes.

● All changes must be documented in the Incident Management Plan within three

(3) days of the change and provided to Incident Response Team members and

Departments’ leadership and applicable stakeholders.

Update Training

● If necessary, update training procedures and materials to prevent the incident from reoccurring.

Is Continued Monitoring Necessary?

● Determine if it is necessary for the incident and its aftermath to be monitored further.

Close the Incident and Prepare for the Future

OMIS Incident Management Plan – v.2.4 - Page 5 of 20 https://privacy.wv.gov/SiteCollectionDocuments/Privacy%20Policies/1a%20Response%20to%20Unauthorized%20Disclosures%20Revision%20Final%2010.6.14.pdf

Office of Shared Administration

● When ready, close the incident and prepare a historical document so that the incident can be remembered and not repeated. Foster “institutional memory.”

● When staff changes occur, inform new team members of the existence of the historical documents so they may benefit from the past experience.

● Prepare a summary report for the DH, DHF, and the DoHS Cabinet Secretaries, the

OMIS Chief Information Officer, OMIS Information Security Officer, the Office of

Technology, and the State Privacy Office.

OMIS Incident Management Plan – v.2.4 - Page 6 of 20

Office of Shared Administration

Start An incident occurs OMIS Incident Management Plan Flowchart

OMIS Incident Management Plan – v.2.4 - Page 7 of 20

Office of Shared Administration

Report the Incident

When faced with a security incident or an unauthorized disclosure, whether real or perceived, report information security breaches or unauthorized disclosures immediately, or no longer than 15 minutes, after discovery. All security incidents and/or unauthorized disclosures must be reported concurrently to WVOT and OMIS. Depending on the nature of the incident, it must be reported to the Internal Revenue Service (IRS), the Social Security Administration (SSA), and/or the Centers for Medicare and Medicaid Services (CMS). See OMIS OP-30, Incident

Reporting and Response.

Section 3.4 of OMIS Procedure #OP-30: Incident Reporting and Response:

3.4 Reporting Security and Privacy Incidents/Unauthorized Disclosures

3.4.1 As specified by WV State Code, and Executive Branch Information Security and Privacy policies, all Agency employees, contractors, and users of State systems must report suspected or detected information security breaches or unauthorized disclosures immediately, or no longer than 15 minutes, after discovery.

3.4.2 Because the Departments and their contractors are supported by WVOT systems and networks, all security incidents and/or unauthorized disclosures must be reported concurrently to WVOT and OMIS. Users must access the WVOT Online Computer

Security and Privacy Incident Reporting System

(https://wv.accessgov.com/technology/Forms/Page/incident-reporting/incident-reporti ng/1) and complete an Incident Report Form, and then contact OMIS at

OSAIncident@wv.gov (using the subject line “INCIDENT”). If the suspected incident or

OMIS Incident Management Plan – v.2.4 - Page 8 of 20 https://wv.accessgov.com/technology/Forms/Page/incident-reporting/incident-reporting/1 https://wv.accessgov.com/technology/Forms/Page/incident-reporting/incident-reporting/1 mailto:DHHRIncident@wv.gov

Office of Shared Administration disclosure is thought to be critical or ongoing, employees should call the WVOT Service

Desk at 304-558-9966. All reports must include the following information:

● Contact Information (Name, Phone Number, Agency, Cell/Pager)

● Physical Location of Incident (include building number, room number, etc.)

● Date and Time Incident Occurred

● Is the Incident still ongoing? (yes/no)

● Physical Location of Incident (include building number, room number, etc)

● Date and Time Incident Occurred

● Enter a brief summary of the reported incident. If known, enter what you think has or is happening.

o Examples of incidents include, but are not limited to:

o Lost or stolen laptop computers or other portable devices o Lost or stolen media that contains sensitive data o Rampant computer virus infections within the State network o Loss of system or network functionality o A disaster scenario or act of terrorism o A prolonged power outage o A compromised (hacked) computer or server o A defaced Web page o An information security policy violation

● Briefly describe the impact of the reported incident. If known, include the number of affected critical systems, computers, networks, users and/or agencies.

OMIS Incident Management Plan – v.2.4 - Page 9 of 20

Office of Shared Administration

3.4.3 If the incident involves either a suspected or known incident or unauthorized disclosure of sensitive and restricted PHI, PII, FTI, PCI data, or SSA data, the OMIS Information

Security Officer (ISO) will also notify the following entities: the IRS, the SSA, and the

Centers for Medicare and Medicaid Services (CMS).

3.4.4 The OMIS ISO must report to CMS all potential or confirmed security incidents within one (1) hour of discovery. Upon receiving notice of the incident report, the ISO must notify the following entities:

3.4.4.1 Any event warranting a disconnect from the system-to-system connection to CMS and/or the Federal Services Data Hub (FDSH) must be reported by immediately calling the CMS IT Service Desk at either 1-800-562-1963 or 1-410-786-2580, or by emailing

CMS_IT_Service_Desk@cms.hhs.gov. CMS will work with the Agency for the duration of the incident and notify any affected federal agencies.

3.4.4.2 The designated SSA Regional Office Contact and/or the SSA Systems Security Contact by both phone and email. The ISO must then notify the SSA regional office contact or the

SSA Systems Security Contact identified in the agreement. If, for any reason, the ISO is unable to notify either of these contacts within the one (1) hour timeframe, he/she must report the incident to the SSA National Network Service Center (NNSC) at

877-697-4889 (select “security and PII reporting” from the options list). If the ISO cannot reach the SSA contacts or the NNSC, he/she will contact the SSA’s Office of

Information Security, Security Operations Center (SOC) at 1-866-718-6425. The ISO will use a PII Loss Reporting Worksheet to gather and organize information about the

OMIS Incident Management Plan – v.2.4 - Page 10 of 20 mailto:CMS_IT_Service_Desk@cms.hhs.gov

Office of Shared Administration incident and will provide SSA timely updates as any additional information about the loss of PII becomes available.

3.4.5 If the incident involves a possible improper inspection or disclosure of FTI, including breaches and incidents, by a state employee, a contractor, or any other person, the individual making the observation or receiving information must perform the following steps:

3.4.5.1Contact the OMIS ISO, who must then contact the IRS Office of Safeguards at safeguardreports@irs.gov. The ISO must outline for the IRS the specifics of the incident or breach known at the time into a data incident report, including but not limited to the following:

● Point of contact information for the incident (include name, name of Department, email address, phone and cell numbers);

● Date and time the incident occurred (mm/dd/yy and hh:mm:ss am/pm), if known;

● Date and time the incident was discovered (mm/dd/yy and hh:mm:ss am/pm);

● How the incident/breach was discovered;

● A brief summary of the reported incident (i.e., Description of the incident/breach and the data involved, including specific data elements, if known);

● Potential number of FTI records involved; if unknown, provide a range if possible

● Physical location of incident (include street address, building number, room number, etc.);

● IT involved (e.g., laptop, server, mainframe)

● Does the incident involve unauthorized access or disclosure by an agency employee?

(Y/N)

● If a criminal indictment is not pursued, will a disciplinary or adverse action be proposed against the agency employee involved in this unauthorized access or disclosure? (Y/N)

3.4.5.2 After reporting the incident or breach, the OMIS ISO must immediately conduct an internal investigation to determine if FTI was involved.

OMIS Incident Management Plan – v.2.4 - Page 11 of 20

Office of Shared Administration

3.4.5.3 Reports must be sent electronically and encrypted via IRS-approved encryption techniques as outlined in Publication 1075, Section 2.E.3, Encryption Requirements. Use the term “data incident report” in the subject line of the email. FTI must not be included in the data incident report.

3.4.5.4 Even if all information is not available, the OMIS ISO must immediately notify the IRS of the suspected or known incident or breach. Additional information must be provided to the Office of Safeguards as soon as it is available.

3.4.5.5 The Office of Safeguards will coordinate with the Departments regarding appropriate follow-up actions required to be taken to ensure continued protection of FTI. Once the incident has been addressed, the OMIS must conduct a post-incident review to ensure the incident response policies and procedures provide adequate guidance.

3.4.5.6 The Departments must provide written notification to any taxpayer whose FTI was subject to unauthorized access or disclosure when a disciplinary or adverse action is proposed against a Department employee responsible. The written notification must include the date of the unauthorized inspection or disclosure and the rights of the taxpayer under IRC § 7431.

3.4.5.7 The Departments must confirm to the Office of Safeguards when the required written notification to the taxpayer is completed and of any pending media releases, including sharing a draft of the release, prior to distribution.

3.4.6 The OMIS ISO will notify the OMIS Chief Information Officer (CIO) of all information security incidents as defined in the WVOT Incident Management Plan (WVOT-PL1007), and other incidents as defined in OMIS OP-30 – Incident Reporting and Response procedure.

3.4.7 The OMIS CIO will notify the DH, DHF, and DoHS Cabinet Secretaries and others, as appropriate.

OMIS Incident Management Plan – v.2.4 - Page 12 of 20

Office of Shared Administration

3.4.8 Incident investigations will begin immediately upon receipt of reporting and will be conducted in concurrence with notification to regulatory agencies, as required. After completing the initial notifications the OMIS ISO will submit all incident reporting documentation to applicable state and federal entities.

3.4.9 The OMIS ISO will collaborate and cooperate with federal, state, and local authorities, and with WVOT to implement an incident management plan and to expedite mitigation strategies.

3.4.10 When necessary, designated individuals within OMIS will work with the DoH, DHF, DFS and the OSA Privacy Office and/or the WVOT to classify the disclosure; recover lost or stolen sensitive and restricted PII, FTI, SSA data, PCI data, or PHI; determine whether it is necessary to notify impacted individuals; and activate the appropriate response team.

More detailed information is outlined in Section 4.5 of the West Virginia State Privacy Office policy WVEB-P101.1.

OMIS Incident Management Plan – v.2.4 - Page 13 of 20 https://privacy.wv.gov/SiteCollectionDocuments/Privacy%20Policies/1a%20Response%20to%20Unauthorized%20Disclosures%20Revision%20Final%2010.6.14.pdf

Office of Shared Administration

Document the Incident

Document the incident in detail using the Post Incident Response Assessment, available from the WV

State Privacy Office: https://privacy.wv.gov/incidentresponse/Pages/default.aspx.

The report must be provided to the parties listed below within 30 calendar days of filing the initial

Incident Report:

● State Privacy Office

● Office of Technology – Chief Technology Officer & Chief Information Security Officer

● DH, DHF, DoHS, and OSA Cabinet Secretaries

● Director of the Board of Risk and Insurance Management (BRIM)

● Others as applicable

The Post Incident Response Assessment collects the following information:

Section 1 – Incident Reporting Contact Information

● Department/Agency/Division

● Name (of person who reported the incident)

● Phone Number

● Email

● Department Privacy Officer

● Agency/Division Privacy Officer (if applicable)

● Office of Technology (OT) Incident Tracking Number

OMIS Incident Management Plan – v.2.4 - Page 14 of 20 https://privacy.wv.gov/incidentresponse/Pages/default.aspx

Office of Shared Administration

Section 2 – Incident Information

● Date incident occurred or timeframe during which the incident occurred

● Date of initial incident report

● Physical location of the incident

● How was the incident reported?

● How was the incident discovered?

● Brief description of the incident and any action taken at time of discovery to contain or minimize its impact

● Was the data containing Personally Identifiable Information (PII) encrypted, rendering the data elements unusable, unreadable or indecipherable? If PHI was compromised, was it encrypted per DHS Guidance 74 FR 19006 (2009)? (See the following link:

https://www.federalregister.gov/documents/2009/04/27/E9-9512/guidance-specifying-th e-technologies-and-methodologies-that-render-protected-health-information.)

● Has it been determined by the Agency Privacy Officer that the incident is only an event that has now been resolved?

● Was the incident the result of policies not being followed?

● When was policy/procedure training last presented to the employees involved in the incident?

● Provide the names of the individuals who participated in managing the incident response.

● Type of Incident

● List types of PII (including PHI) that were disclosed. (NOTE* Do not list actual PII)

● Number of individuals affected or potentially affected.

● If a privacy complaint was filed by an individual who alleges their PII was inappropriately accessed or disclosed, did the complainant receive a response from the department?

OMIS Incident Management Plan – v.2.4 - Page 15 of 20 https://www.federalregister.gov/documents/2009/04/27/E9-9512/guidance-specifying-the-technologies-and-methodologies-that-render-protected-health-information https://www.federalregister.gov/documents/2009/04/27/E9-9512/guidance-specifying-the-technologies-and-methodologies-that-render-protected-health-information

Office of Shared Administration

Section 3 – Summary of Risk of Harm / Compromise Assessment

Complete and attach one of the following forms to the Post-Incident Response Assessment:

● Risk of Harm Assessment (ROHA) for HIPAA-related incidents (https://privacy.wv.gov/incidentresponse/Documents/BLANK%20PIRA%20v8%20081222.pdf)

● Risk of Compromise Assessment (ROCA) for non-HIPAA incidents (https://privacy.wv.gov/SiteCollectionDocuments/Incident%20Response/ROCA.pdf)

Both are available from the WV State Privacy Office (https://privacy.wv.gov/incidentresponse/Pages/default.aspx.)

Section 4 – Notification to Individuals

Indicate the notification status for the incident. The following options are available:

A. Notification is not required.

B. Notification is required and was already issued due to time constraints.

C. Notification is mandated or appropriate. Request approval from the Board of Risk and Insurance

Management (BRIM) prior to notification.

(For more information, see section 4.5.11 of WVEB-P101.1 Response to Unauthorized Disclosures from the WV State Privacy Office and sections 46A-2A-101 and 46A-2A-102 of the West Virginia Code.)

Approval for notification to individuals or the Office of Civil Rights (OCR) follows this process:

● BRIM must approve in advance the notification to individuals or the OCR, unless the timeframe does not permit BRIM approval due to other regulations (such as FTI regulations)

● To receive approval, submit a thorough draft of the Post Incident Response Assessment

(PIRA), the ROCA or ROHA, and a draft of the notification to the State Privacy Office.

● After approval of the notification is received and the notifications are issued, submit the final PIRA, ROCA, or ROHA, and a copy of the notification to BRIM.

OMIS Incident Management Plan – v.2.4 - Page 16 of 20 https://privacy.wv.gov/incidentresponse/Documents/BLANK%20PIRA%20v8%20081222.pdf https://privacy.wv.gov/SiteCollectionDocuments/Incident%20Response/ROCA.pdf https://brim.wv.gov/privacy/Pages/default.aspx

Office of Shared Administration

● If the timeframe for notification does not allow for BRIM approval, submit the final

PIRA, ROCA, or ROHA, and a copy of the notification within three business days after notifications are issued to BRIM.

Indicate the format of the notification (Final PIRA only – post notification)

● Letter

● Email

● Other

Section 5 – Incident Outcome

Describe the outcome of the incident. (Be specific and include actions taken to resolve and/or mitigate the incident.) If a police report was filed, attach a redacted copy.

What measures have been, or will be, implemented to prevent this type of incident from reoccurring?

● Additional Training

● Departmental Policy or Procedure Change – Security

● Departmental Policy or Procedure Change – Privacy

● System Change

● Improved Monitoring

● Physical Security Change

● Other

OMIS Incident Management Plan – v.2.4 - Page 17 of 20

Office of Shared Administration

Communications

Determine if it is necessary to distribute a press release. Refer to section 46A-2A-101 of the West

Virginia Code and section 13402(e)(2) of the HITECH Act below.

Section 46A-2A-101 of the West Virginia Code

According to section 46A-2A-101 of the West Virginia Code, the Agencies can provide notice of the incident by letter, telephone call, or electronic means (if consistent with the Electronic Signatures in

Global and National Commerce Act). Alternatively, a substitute method of notice, such as a press release, can be used in the following situations:

● The cost of providing the notice will exceed $50,000.

● The group of residents to be notified exceeds 100,000 people.

● The Agency does not have sufficient contact information to reach the people.

● At the discretion of the Cabinet Secretary.

Section 13402(e)(2) through 13402(e)(4) of the HITECH Act According to Section 13402(e)(2), “Notice shall be provided to prominent media outlets serving a State or jurisdiction, following the discovery of a breach . . . if the unsecured protected health information of more than 500 residents of such State or jurisdiction is, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach.” In other words, if the PHI of more than 500 West

Virginia citizens has been disclosed, a press release is required.

Also, note that section 13402(e)(3) requires the Agency to notify the Secretary of the U.S.

Department of Health & Human Services if a PHI breach of data of more than 500 individuals has

OMIS Incident Management Plan – v.2.4 - Page 18 of 20

Office of Shared Administration occurred. Section 13402(e)(4) requires the Secretary to post a list of such breaches on the

Department’s website.

Communications Plan

If an incident press release is necessary, follow the plan outlined below.

1. The DH, DHF, DoHS, and OSA will work with the WV State Privacy Office, which will issue the press release.

2. While the event is ongoing, the Chief Privacy Officer will serve as the media contact and will handle all queries from the media.

3. The DH, DHF, DoHS, and OSA will follow a staff notification plan

a. Communicate situation information and procedural instructions to employees and stakeholders.

b. Remind staff to refer all questions to the Agency Privacy Officer and not discuss the incident in or out of the office.

4. Periodically review the plan to ensure that procedures work effectively, and materials are up to date.

5. Before and during the incident, be prepared with the following assets:

● List of external contacts, e.g., media, vendors, and government agencies.

● Call log to track inquiries from the media and others.

● List of external organizations contacted.

● Chronological list of actions taken during the incident.

OMIS Incident Management Plan – v.2.4 - Page 19 of 20

Office of Shared Administration

For more information, note these resources:

U.S. Department of Health and Human Services Office for Civil Rights Breach Portal: Notice to the

Secretary of HHS Breach of Unsecured Protected Health Information

(https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html)

Health Information Technology for Economic and Clinical Health Act (HITECH)

(https://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-fina l-rule/index.html)

TechTarget’s Developing An Emergency Communications Plan: A Template For Business Continuity

Planners

(https://www.techtarget.com/searchdisasterrecovery/Developing-an-emergency-communications-plan-A

-template-for-business-continuity-planners)

National Emergency Communications Plan

(https://www.dhs.gov/xlibrary/assets/national_emergency_communications_plan.pdf)

Section 4.5.13 of WVEB-P101.1 Response to Unauthorized Disclosures

(https://privacy.wv.gov/SiteCollectionDocuments/Privacy%20Policies/1a%20Response%20to%20Unautho rized%20Disclosures%20Revision%20Final%2010.6.14.pdf

OMIS Incident Management Plan – v.2.4 - Page 20 of 20 https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html https://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html https://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html https://www.techtarget.com/searchdisasterrecovery/Developing-an-emergency-communications-plan-A-template-for-business-continuity-planners https://www.techtarget.com/searchdisasterrecovery/Developing-an-emergency-communications-plan-A-template-for-business-continuity-planners https://www.dhs.gov/xlibrary/assets/national_emergency_communications_plan.pdf https://privacy.wv.gov/SiteCollectionDocuments/Privacy%20Policies/1a%20Response%20to%20Unauthorized%20Disclosures%20Revision%20Final%2010.6.14.pdf https://privacy.wv.gov/SiteCollectionDocuments/Privacy%20Policies/1a%20Response%20to%20Unauthorized%20Disclosures%20Revision%20Final%2010.6.14.pdf