Incident Triage

On an incident's page, the Breach triage panel helps you respond under the Breach Notification Rule. It has two clearly separated halves.

Notification deadlines (computed, exact)

When PHI/ePHI is marked involved, Prusik Health computes the notification deadlines directly from the incident's discovery date and affected count — no AI, no guessing:

• Individual notice — within 60 days of discovery (§164.404).
• HHS notice — within 60 days for breaches affecting 500 or more (§164.408(b)); otherwise via the annual log within 60 days of year-end (§164.408(c)).
• Media notice — required only for more than 500 residents of a single state or jurisdiction (§164.406).

These dates come from the rule, not the model.

HHS 4-factor assessment (AI draft)

When AI is enabled, Draft HHS 4-factor assessment asks Ryland to draft the §164.402 risk assessment — the nature of the PHI, the unauthorized recipient, whether it was actually acquired or viewed, and the extent of mitigation — plus an overall recommendation (likely breach / low probability / insufficient info).

Grounding & safety

• Only the incident's own fields are used — including the staff-written description, which may itself contain patient information. That narrative goes to the same BAA-covered, zero-retention model service as evidence files do, and the model is instructed never to quote it back in its factors or rationale. Record the disclosure the same way you would for evidence you attach.
• The 4-factor output is a draft decision aid. The final breach determination is always a human decision — a privacy officer must make it and record it in the incident's timeline notes. When details are thin, Ryland leans to "insufficient information."