Incidents

IMPORTANT: Functionality for Incident Reporting is also now contained in the Admin Module. Please see the Admin Module Overview knowledge base article for more details.

The Incident Module allows an Organization to manage the Incident Reporting/Response requirements from within The Guard. The Guard also allows for Employees to Report. Compliancy Group also aids with Incidents that have been reported and after certain steps have been completed to compile necessary information (see KB Section for Incident and Breach Support). 

TABLE OF CONTENTS

• Creating and Managing an Incident

Creating and Managing an Incident

Creating an Incident can be done in 2 ways:

1. An Officer/Admin may create an Incident via the Incident Module and fill in the form themselves

2. Any Employee in The Guard may use the Incident Reporting URL/Portal for the Organization. An Officer/Admin may generate this URL and provide it to their team. This can be done in the Admin Module. Please see Admin Module Overview for more details.

When creating an Incident, a Form is provided where basic and immediate information can be entered. Additional features are available once the Incident has been created. 

1. Navigate to Incidents module

2. Select Add Incident

   1. Location – Select the Location affected by the Incident (If the Org just has the 1 Location, select this)

   2. Vendor Reported – If the Incident is related to a Vendor, select the Vendor from the dropdown. This requires the Vendor to be created in the Vendor Module

   3. Incident Title – Name the Incident

   4. Reported By – Identify the person reporting the Incident; This can also be done Anonymously

   5. Incident Type – Select from preexisting Incident Types provided by The Guard that best fit the scenario; Otherwise, use “Other” and then type out the type of Incident

   6. Investigation Status – When creating an Incident, this cannot be changed

   7. Incident and Discovery Date – 

      1. “Incident Date” – The date in which the Incident occurred

      2. “Discovery Date” – The date in which the Incident was discovered – When the Organization was made aware that an Incident/the Incident occurred

   8. Incident Affected More than 500 Members – There is a checkbox that an Organization can select if the Incident affected more than 500 Individuals – This will affect Breach Notification (see policies), if more than 500 individuals are affected.

3. The Description, Investigation, Notes, and Evidence fields do not need to be filled in to Save New Incident and create the incident. Each of these fields can be updated after creation and continuously as the organization continues to investigate.

   1. Description – Full details on the Incident

   2. Investigation – Task creation for tracking steps of the investigation as well as to-dos related to the Incident overall

   3. Notes – Notes

   4. Evidence – Evidentiary upload, if required

      1. DO NOT UPLOAD ANY DOCUMENTS CONTAINING PHI/ePHI INTO THE GUARD

4. Once the Incident has been created, it can be selected from the Incidents module via the table. The Status of Incidents may also be adjusted via the Choose Action or Hamburger Button menus. 

   1. NOTE: All Incidents have the Not Verified status by-default

   2. Under Investigation Selected – Changes status for the checked objects to Under Investigation

      1. The Organization is investigating the Incident/Breach and making necessary adjustments/updates

   3. Verify Selected – Changes status to Verified for the selected Incidents

      1. The middle-ground between when an Incident is being Investigated and then when the Incident has been Verified that either a Breach has occurred or not

      2. Marking an Incident as “Verified” has no affect on the Incident itself and could be skipped, unless managing multiple Incidents at once as this will help identify those incidents that are still under investigation or those that are nearing “completion”

   4. Complete Selected – Changes status to Completed

      1. Signifies that an Incident has been completed

      2. A Completed Incident cannot be updated once Completed – The Incident’s status must be adjusted in order to “reopen” it

Additional details and steps, with Job Aid documentation, can be located in the Knowledge Base section for (Legacy) Incidents - https://compliancygroup.freshdesk.com/support/solutions/folders/48000693212