The Data Breach Response Draft

Help me prepare a response framework in case patient information
is inadvertently entered into an AI tool.

Setting: [DESCRIBE]
Jurisdiction and applicable breach notification law:
[HIPAA / GDPR / OTHER]

Produce:
1. Immediate actions in the first hour
2. Who must be notified internally, and in what order
3. What documentation should be created and when
4. The assessment questions that determine whether this is a
   notifiable breach
5. A staff communication that explains what happened without
   blame, so people report rather than hide the next one
6. Prevention measures to implement afterwards

This is a draft framework for review by my privacy officer, not
legal advice.