Draft Affected Individual Notification Letter

Skill: Draft Affected Individual Notification Letter for Healthcare Data Breach

1. Subject-matter triage

• Treat this as a two-deliverable drafting task: a plain-language affected-individual notice and a separate attorney-facing cover memo.
• Draft the notification letter first, using the forensic findings as the factual anchor; prepare the memo only after the letter has a complete, internally consistent factual basis.
• If the source set contains multiple incident summaries, timelines, or versions of the event narrative, enumerate them before reconciling differences.
• If only one incident, one notice population, and one notification pathway are in scope, state that explicitly and proceed on that basis.

2. Failure modes the skill is correcting

• The letter becomes generic because it is not grounded in the incident’s confirmed facts.
• The writer imports a template’s assumptions without testing them against the forensic findings and the other source documents.
• The letter overstates or understates the compromised data categories, creating avoidable legal and reputational risk.
• The cover memo is omitted, or it merely repeats the letter instead of identifying cross-document inconsistencies and compliance concerns.
• The draft ignores timing, recipient, and content constraints that are specific to healthcare breach notice practice.
• The memo flags issues abstractly but does not tie each issue to a concrete source-document mismatch and a practical fix.
• The deliverables are written as if the notice itself should contain legal analysis, instead of keeping analysis in the memo.

3. Legal frameworks / domain conventions that apply

• HIPAA Breach Notification Rule: 45 C.F.R. Part 164, Subpart D governs individual breach notices and related content, timing, and administration.
• Individual notice content convention: the letter should explain what happened, what information may have been involved, what the recipient should do, what the organization is doing, and how to contact the organization.
• Plain-language drafting convention: use direct, lay-readable language and avoid technical or forensic jargon unless it is necessary and immediately explained.
• Factual accuracy convention: the notice must track the forensic record; a breach notice is not the place to speculate about categories not confirmed by the investigation.
• Cross-document consistency convention: the notice, incident memo, template, and compliance matrix should tell one coherent story on scope, timing, and remediation.
• Attorney-facing memo convention: the cover memo should identify discrepancies, explain why they matter under the applicable notice rule, and recommend how to resolve them before mailing.
• If the source documents identify a specific timing rule, privacy standard, or operational checkpoint, carry that rule into the draft and memo rather than paraphrasing it away.

4. Analytical scaffolds

• Read the forensic report first and extract the confirmed incident narrative, discovery date, exposure window, data categories actually implicated, affected population, and remedial steps already taken.
• Compare the notice template against the forensic findings and identify any template language that is too broad, too narrow, or inconsistent with the confirmed facts.
• Compare the incident response memo and the compliance matrix against the same factual baseline; note any mismatch in description, timing, audience, or remediation status.
• Draft the letter so every factual statement is supportable by the source set; if a fact is not confirmed, either omit it or frame it cautiously.
• Keep the letter focused on recipient impact and next steps; reserve legal risk analysis, inconsistency analysis, and drafting rationale for the memo.
• In the memo, itemize each inconsistency, state why it matters under the applicable notice requirements, and recommend a concrete fix before issuance.
• When there are multiple affected data categories, multiple exposure periods, or multiple notice obligations, handle each separately rather than collapsing them into one generalized statement.
• If the record is incomplete, identify the gap and draft conservatively around it, rather than filling it with assumptions.

5. Vertical / structural / temporal relationships

• Use the forensic report as the highest-fidelity factual source for the notice narrative.
• Use the template as a form reference only; do not let boilerplate displace source-specific facts.
• Use the incident response memo to detect shifts in characterization, scope, or response posture.
• Use the compliance matrix to check whether the notice content and timing align with the documented compliance path.
• Where the documents conflict, explain in the memo which version appears most reliable, what remains unresolved, and what must be confirmed before mailing.
• Track the sequence of events chronologically: incident, discovery, containment, assessment, notice preparation, and planned mailing.
• If the notice timing is tied to a regulatory or contractual milestone, preserve that timing relationship in the memo and in any internal drafting notes.

6. Output structure conventions

• Produce exactly two files: a notification letter and a cover memo.
• The notification letter should be formatted as a recipient-facing letter, with clear headings or paragraphs as needed, and written in plain language.
• The letter should include only the facts and instructions needed by the affected individual; do not embed legal analysis or internal debate.
• The cover memo should be attorney-facing, privileged in tone, and organized around identified discrepancies, compliance risks, and suggested fixes.
• The memo should end with a concise recommended actions section that assigns each next step to the appropriate role and ties it to a practical timing anchor from the source set or the notification deadline.
• Keep the deliverable filenames exactly as instructed: notification-letter-draft.docx and cover-memo.docx.
• Before finishing, ensure the letter contains operative notice content rather than a summary of what the notice should say, and ensure the memo contains actual issue-spotting and remediation guidance rather than a restatement of the facts.