When should a privacy breach be reported?

• A. Immediately per policy and document.
• B. After a formal audit.
• C. Only if a patient complains.
• D. Within 24 hours.

Answer: (A)

Prompt reporting of a privacy breach is essential. When a breach occurs, the priority is to contain the exposure, assess the impact, and escalate it to the designated person or team so they can initiate the incident response, document exactly what happened, and determine required notifications. Waiting for an audit, waiting for a patient to complain, or restricting reporting to a 24-hour window can allow further risk and may violate policy and legal obligations. Reporting immediately per policy and documenting it provides the fastest route to containment, investigation, and any required notifications.