The medical assistant gave proper notice. In her last two weeks, she copied everything.

The departure notice. A four-year medical assistant — a long-tenured employee with strong patient relationships — gave 60 days notice in early autumn. She cited a move closer to family. She offered to help train her replacement, which the practice appreciated. Nothing about her departure raised flags. Her access was not modified.

Weeks one through six. The MA worked her shifts. She trained the new hire. She covered for two providers during a conference week. She did not exfiltrate anything during this period.

Last two weeks. On her personal phone — a BYOD device she had used to access the practice's EHR mobile app since her first month — she pulled up patient lists for the providers she worked most closely with and used the app's export-to-share feature to send copies to her personal email. From her personal laptop, used on the practice Wi-Fi for the web version of the billing system, she downloaded billing exports and took screenshots of internal physician notes. Everything she touched sync'd to her personal Dropbox automatically.

The last shift. She returned her badge. She turned in her practice-issued workstation. Nobody asked about her personal phone or laptop. Her practice email was offboarded the same day. Her EHR account was disabled the following Monday. The practice had no record of what she had downloaded because the EHR vendor's audit log access required a support ticket they had never opened.

Eleven days later — the patient call. A patient called the practice manager to ask why the new orthopedic practice across town already had her treatment history. She had not authorized any release. The practice manager checked the EHR — no release was on file. She called the practice owner. The owner spent the rest of the day on the phone with breach counsel.

Days 11 to 22 — the investigation. Breach counsel engaged DFIR. The EHR vendor finally produced an audit log going back 90 days. The pattern was unmistakable: hundreds of chart views, dozens of patient list exports, and four billing downloads — all from the MA's account, all in her last two weeks. Subpoenaed cloud forensics later confirmed the destination: personal Dropbox synchronized to her home computer.

Day 22 — notification filed. The practice filed an HHS-OCR breach notification covering 4,200 individuals. State attorney general notifications followed in three states where patients resided. HHS-OCR opened an investigation that same week. HHS-OCR's first written question was: why did notification take eleven days after discovery.

Eighteen months later. The practice signed a $1.8M resolution agreement with HHS-OCR and a corrective action plan covering access controls, BYOD policy, departure procedures, audit log access, and an annual third-party compliance review. The MA faced separate civil action. The practice kept its license, kept most of its providers, and absorbed a 9 percent patient-attrition impact over the following year.

First call — evidence preservation. We do not call the former employee. We do not call her new employer. We preserve the EHR audit log, the billing system audit log, and every endpoint she used while she was an employee. Breach counsel drives the legal posture from minute one.

Days 1 to 5 — scope and notification readiness. We work backward from every patient chart she touched in her final two weeks. We classify what was viewed, what was exported, and what left the practice. The scope determines the notification list. We prepare a notification package that can be filed quickly — not eleven days later — and update it as the investigation refines the scope.

Week 2 — compelled discovery on personal cloud. Through counsel we pursue cloud forensics on the personal accounts where the data was sent. Where the former employee cooperates, we confirm deletion. Where she does not, we preserve options for civil recovery.

Weeks 3 to 8 — HHS-OCR response. We assemble the evidence package HHS-OCR expects: access logs, audit trail, breach risk assessment, corrective action proposal, training records, policies. We do not let the practice answer HHS-OCR free-form. Every response goes through counsel.

Months 2 to 6 — corrective action plan execution. We roll out DLP across endpoints, configure conditional access on EHR mobile, rebuild the departure procedure with a documented checklist tied to HR's exit process, and stand up quarterly access reviews for every clinical role.

Ongoing.The practice operates under quarterly attestation with HHS-OCR for the next three years. We provide the evidence package each quarter. The practice owner's job is to run the practice; our job is to produce the audit-ready evidence on her behalf.