A patient-data incident hit the local news before patients had been told.

How we helped a healthcare provider tell patients first, satisfy regulators and keep the story local.

Client

Multi-site outpatient provider, ~900 employees

Engagement

Crisis response

Duration

5 weeks

A quiet clinic reception at dusk with a stack of sealed envelopes on the counter

36 hrs

to notify every affected patient directly

1 cycle

of local coverage, with no national pickup

94%

patient retention at the affected sites after 90 days

36 hrs

to notify every affected patient directly

1 cycle

of local coverage, with no national pickup

94%

patient retention at the affected sites after 90 days

The situation

A third-party scheduling vendor reported unauthorised access to appointment records covering roughly 14,000 patients across four sites. Before the provider had confirmed which records were affected, a local reporter received a tip from a staff member and called for comment with a same-day deadline.

The provider faced three audiences with conflicting needs. Patients deserved to hear first. Regulators required specific language and timing. Staff were anxious and already talking. Legal advice was, understandably, to say as little as possible until the forensic review was complete.

The provider had never faced a public incident. Its communications were handled by a two-person marketing team, and the obvious risk was that patients would learn about the incident from the evening news before receiving any word from the people who held their records.

Our response

Priya Nair and Tomás Reyes worked alongside the provider’s general counsel from the first hour. We agreed with counsel on what could be said accurately before the forensic review finished, which was more than the team expected. The reporter received a short, honest statement by the deadline, confirming the incident, the steps taken and the commitment to notify patients directly.

We sequenced everything else so nobody learned something important from the news: staff briefing that evening, patient letters and a call-centre script within 36 hours, and regulator notification drafted with counsel to the required standard. A single FAQ page answered the questions patients were actually asking.

Over the following weeks we issued two factual updates as the forensic review progressed, each saying exactly what had changed since the last. We also prepared site managers for conversations with worried patients at reception, which is where much of the reassurance actually happened.

How it unfolded

Day 1, 10:00: vendor reports unauthorised access; Halloran engaged through counsel
Day 1, 15:30: a local reporter calls with a same-day deadline
Day 1, 17:00: an accurate, counsel-approved statement goes to the reporter
Day 1, 19:00: all-staff briefing and manager talking points issued
Day 2: patient letters, call-centre script and online FAQ live
Day 3: regulator notification submitted, drafted with counsel
Weeks 2–4: two factual updates as the forensic review progresses
Week 5: post-incident review and an updated crisis plan

What we delivered

Same-day media statement, approved by counsel
Staff briefing and manager talking points
Patient notification letter, call-centre script and online FAQ
Regulator notification language, drafted with counsel
Daily monitoring of local press, social and patient reviews
Post-incident review and an updated crisis plan

Results

The story ran for one local news cycle and was not picked up nationally. Every affected patient heard from the provider directly within 36 hours, and the patient FAQ answered most call-centre questions before they were asked. Regulators raised no concerns about the communications. After 90 days, patient retention at the affected sites was 94%, in line with the provider’s normal rate.

The provider’s legal team now includes communications in its incident-response exercises. The updated crisis plan contains pre-approved patient and staff templates for three data scenarios, so the next first statement can go out in minutes rather than hours.

The takeaway

“We don’t know yet” is a legitimate thing to say publicly, as long as it’s paired with what you are doing and when you’ll say more. Agree with counsel, now, what you could say in the first hour of a data incident, and make sure the people affected hear it from you before they read it anywhere else.

“Our patients heard it from us first. That was the only thing I cared about, and they made it happen in a day and a half.”

— General Counsel, Brightwater Health

Led by