Report an Incident
How to File a Privacy or Security Incident Report
Workforce members should complete a Privacy Incident Report if an unauthorized
disclosure or acquisition of private data occurs, or is suspected to have occurred. But first, take steps to correct the situation, if possible. For
example: rescue the document left in a public place; shut down the affected computer, network, or server; or lock up an area with access to private data.
If the breach involves a computer system containing private data:
- Take immediate steps to secure the affected system – unplugging is best. Follow your department’s information security procedures.
- Report the breach, along with your contact information, immediately to your supervisor, your Unit Information Security Manager, and the UF Privacy Officer (Gainesville) or HIPAA Compliance Manager (Jacksonville only).
- If a computer or other data management device has been lost or stolen, also notify the University Police Department, the Jacksonville Sheriff’s Office, or your local law enforcement agency, as appropriate.
Complete a Privacy Incident Report immediately, if possible, but no later than the end
of your shift, workday, or class-day. Two forms are available: one for Protected Health Information and one for Private Data (other than health
Send the Privacy Incident Report to the Privacy Office immediately.
- For UF-Gainesville, all FGP / UFP Clinics, and all remote clinical practice sites: send to UF-Gainesville Privacy Office
- For UF-Jacksonville and all UFJPI/ UFJHI Clinics: send to UF-Jacksonville Office of the General Counsel and HIPAA Compliance.
After investigation, if notification of affected persons or mitigation is required, departments and/or individuals involved in the privacy breach may be
asked to assist with the notification process and/or in mitigating the harmful effects.
Calls may be placed to the Privacy Office hot-line at any time.
Calls will be answered by office personnel during normal business hours (Monday – Friday, 8:00AM to 5:00PM).
Callers should leave a message at other times, and they will be contacted on the next business day.