Data Breach Notification Readiness Audit

Check preparation for deciding who to tell and when.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Audit breach notification readiness. Our breach procedure, contact list for regulators, insurers and customers, templates, and the last exercise: [BREACH_PROCEDURE]. Types of data we hold and where customers live: [DATA_CUSTOMERS]. Decision makers: [DECISION_MAKERS].

Check whether the procedure helps decide what happened, what data was involved and how many people, who decides to notify, how fast, and what messages say. Look for missing steps such as preserving evidence and recording decisions.

Return a table with Step, Gap (red, amber, green) and Fix, draft notification templates with placeholders and no admissions, and a tabletop scenario. Notification duties and deadlines are [VERIFY] for [JURISDICTION] and must be confirmed with counsel.

Also suggest a decision log template, a short checklist for the first twenty-four hours, and a list of questions to ask the cloud providers and suppliers who may hold the data. Remind me to record decisions with times.

Then build the decision support tools and rehearse them. Create a one-page assessment form that captures what happened, when it was discovered, what data and how many people are involved, the likely risk to them, containment steps, and who has been informed. Provide a decision tree in text for whether notification to authorities or individuals is likely to be needed, written as questions for counsel and not as conclusions [VERIFY] for [JURISDICTION]. Draft templates for a notice to individuals and to an authority with placeholders, plain language and no speculation, and a holding statement for the media. Define roles and a call tree, including legal, insurer, IT, communications and leadership. Add a rehearsal script with three injects. Include record-keeping rules so that decisions and reasons are documented with times. Deadlines and content requirements vary and must be confirmed with qualified advisers.

Keep severity honest: separate confirmed issues from possible ones, give the evidence for each, and recommend a retest after fixes so that closure is verified and not assumed.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Gap table (invented small clinic, one-page review)
Procedure: exists, 3 pages, last reviewed 2021. Contact list: insurer number out of date (red). Regulator contact: not listed (red).
Decision tree: absent (amber). Templates: none (amber). Roles: practice manager decides; backup unnamed (amber).
Exercise: never held.
Draft assessment fields: what happened, when found, data involved, number of people, risk to them, containment, who informed.
Tabletop scenario: a lost unencrypted laptop holding appointment lists for 300 patients. Questions to rehearse: who decides, what is checked first, who is told and when, and where each decision is recorded with the time.
Deadlines and content requirements: [VERIFY] with counsel for [JURISDICTION].

• audit