Case Study

Protecting a system’s reputation during data breach

A venerable not-for-profit health system learned a member of its leadership team had inadvertently caused a massive-scale patient data breach. The system needed to alert patients about the problem while working with federal investigators and minimizing media attention. Leadership quickly assembled legal and crisis-response resources and called on us to coordinate the work with a shared strategic communications plan.

The Solution

We immediately formed a campaign team of system leaders, counsel and communications professionals to manage the crisis as the single source of information. We disseminated information through channels including a dedicated website and call center.

Together, we developed consistent, empathetic messaging to curb misinformation and establish authority on the issue. We then implemented a strategic plan targeting staff, patients and the media.

  • For staff, we distributed talking points and instructions to direct queries to a dedicated call center. We worked with the call center vendor to develop the responses and to convey rapid action.
  • For patients, we drafted letters from the hospital apologizing for the data breach, explaining how it happened, outlining steps being taken and offering free credit monitoring.
  • For media, we developed and proactively shared a press release to control the story. Once the story broke, we monitored and managed responses to traditional and social media.

The Results

Patients had clear information about how to protect themselves after the breach. The health system, meanwhile, suffered minimal media coverage from the data breach. By being transparent and sincerely apologizing, health system leaders maintained staff and community trust. By shaping the story early, media reported the incident in a fair way that inflicted no lasting damage.

Tactics

protecting a systems reputation during data breach

The Takeaway

A nonprofit health system learned that a member of its team caused a data breach. Together, we implemented a strategic plan to protect the institution’s reputation among employees, patients and members of the media.

160,000

patients affected

0

media stories after one week

Approx. 200

calls to the center