Privacy complaints and incident intake
How do we take a privacy complaint or a suspected incident from a patient or a staff member, classify it, route it to the privacy office, and track the investigation to closure with the breach clock running?
Open one case from any report and let the classification start the clocks. When a patient complains about how their information was handled or a staff member reports a suspected incident, Callvu captures the report on a controlled screen (what happened, whose information, when, who was involved, how it was discovered), classifies it (a complaint about a privacy practice, a suspected impermissible use or disclosure, a security incident, a business associate event), applies the organization's severity and the breach risk assessment framework, routes the case to the privacy office and compliance in the Decision Desk with the required decisions (investigate, risk assess, notify, close with reasons), tracks the investigation steps and the notifications on the breach notification clocks, and writes the case and its outcome to the system of record with no retaliation against the reporter.
In scopeComplex: multi-party handoffsCallvu moves: classify, decide, write back
Last updated November 7, 2026.
The problem today
The misdirected fax was reported to a manager on a Friday; the privacy office heard about it when the patient's attorney called.
Privacy problems arrive in every form: a patient who says a relative was told about their diagnosis, a nurse who noticed a colleague looking at a celebrity's chart, a clinic that faxed records to the wrong number, a vendor that lost a laptop. Each is reported to whoever is nearest and handled as that person sees fit. The privacy office learns late, the risk assessment is done from memory, and the sixty-day breach notification clock has been running since discovery.
The HIPAA Privacy Rule requires a complaint process with documentation of every complaint and its disposition, and prohibits retaliation; the Breach Notification Rule treats an impermissible use or disclosure as a presumed breach unless a four-factor risk assessment shows a low probability of compromise, and requires notification to the individuals without unreasonable delay and within sixty days of discovery, to the Secretary, and to the media for large breaches. Discovery is the day any workforce member knew or should have known, which is why the intake matters.
One door for every report, with the clock starting on the report, is the whole difference between a managed incident and a reportable one.
How it runs
From the requestto the system of record.
A patient, a family member, a staff member, a business associate or an AI assistant handling a patient conversation reports a privacy concern or a suspected incident. Callvu opens the case with the report time as the discovery date.
- Reporter
- Describes what happened on a controlled screen, is told the case number and that there is no retaliation, and receives the outcome where they are the complainant.
- Privacy office
- Owns the case, runs the investigation and the risk assessment, and decides in the Decision Desk.
- Compliance
- Reviews notification decisions, sanctions and regulator reporting.
- Callvu
- Captures, classifies, routes, tracks the investigation steps and the clocks, generates the notices and writes back.
Capture and classify
The report is captured with the facts (what, whose information, when, where, who was involved, how discovered, what has been done), the reporter's identity or anonymity choice, and any evidence; it is classified: a complaint about a privacy practice, a suspected impermissible use or disclosure, a security incident, a business associate event, or a question; the classification sets the severity, the owner, the containment steps and whether the breach assessment clock starts.
Decide the investigation and the risk assessment
The case goes to the privacy office in the Decision Desk with the facts and the classification and the required decisions: contain (retrieve the record, revoke the access, stop the fax), investigate with the steps (access logs, interviews, the business associate's report), and apply the four-factor risk assessment (the nature and extent of the information, the unauthorized person, whether it was acquired or viewed, the extent of mitigation) to conclude breach or low probability of compromise with the reasoning recorded.
Notify and sanction
Where a breach is concluded, the notices are generated and sent: to the individuals without unreasonable delay and within sixty days of discovery with the required content, to the Secretary within sixty days for five hundred or more individuals or in the annual log otherwise, to prominent media for more than five hundred residents of a state, and to a state attorney general where state law requires; compliance reviews the workforce sanction under the sanctions policy and the business associate's obligations; the complainant receives the outcome.
Write back and close
The case with the report, the classification, the investigation steps, the risk assessment, the decisions and who made them, the notifications with dates and the sanction is written to the privacy office's system of record and the EHR audit record where the patient's record was involved, and closed with the reasons; the complaint log, the breach log and the annual report to the Secretary are produced from it.
Where it ends: Every report became one case with the discovery date fixed, the privacy office decided the containment, the risk assessment and the notifications on the record, the clocks were met, and the system of record holds the complaint and breach logs the regulator will ask for. The Decision Trace shows the classification, the four factors and each decision; the Audit Trace shows the report, each investigation step, each notice and the closure with time.
Runtime enforcement
What is enforcedwhile the work runs.
The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.
The handoff
Between the front doorand the back office.
The front door
Any reporter in any channel, including a patient conversation with an AI assistant that hands the concern to the controlled screen.
The back office
The privacy office and compliance work one case with the clocks visible; managers report rather than handle.
The Decision Desk
- Every case goes to the privacy office in the Decision Desk with the facts and the classification and the required decisions: contain, investigate, risk assess, notify or conclude low probability with reasons, and close; compliance reviews notifications and sanctions.
Proof
In scope.Proof at scale, not one process at a time.
The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.
23 hospitals in the Ministry of Health network run on Callvu.
Across Callvu customers
More than 1,000 processes are live across Callvu customers.
Across Callvu customers
Questions
What buyers ask next,answered plainly.
When does the breach clock start?
On discovery, which is the first day any workforce member knew or should have known; the intake fixes it as the report time, which is why every report goes through one door.
Is every incident a breach?
An impermissible use or disclosure is presumed a breach unless the four-factor risk assessment shows a low probability of compromise; the assessment and its reasoning are recorded on the case.
Can a staff member report anonymously?
Yes, and the non-retaliation rule applies to every reporter; the case still carries the facts and the discovery date.
Related processes
Bring this process, or the one that costs you most.
We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.