Incident Response Plan

1. Purpose and Scope

This Incident Response Plan ("IRP") establishes the framework, roles, and procedures that Rymeda, Inc. ("Rymeda") follows to detect, contain, eradicate, recover from, and report security and privacy incidents affecting the Rymeda platform, its users, and the Protected Health Information ("PHI") processed on behalf of healthcare providers (Covered Entities).

This plan applies to all Rymeda workforce members (employees, contractors, and temporary staff), all systems and infrastructure operated by Rymeda (including AWS cloud resources, databases, APIs, and client applications), all data processed through the platform (including PHI, personal data, and operational data), and all subprocessors listed on our Subprocessor List.

This IRP is maintained in alignment with the HIPAA Security Rule (45 CFR §164.308(a)(6) — Security Incident Procedures), the NIST Cybersecurity Framework (CSF) Respond function, NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide), and the incident response requirements of our Business Associate Agreement, Data Processing Agreement, and Breach Notification Policy.

2. Incident Classification

All incidents are classified by severity to determine response urgency, escalation path, resource allocation, and notification requirements. Classification is determined at initial triage and may be escalated or de-escalated as the investigation progresses.

Incidents involving PHI or ePHI are automatically classified as Sev 1 (confirmed breach) or Sev 2 (suspected exposure) and trigger the four-factor risk assessment process described in the Breach Notification Policy. Trust and safety incidents (content violations, account abuse) are tracked through the platform's moderation system and may be classified as Sev 3 or Sev 4 unless they involve PHI, unauthorized access, or platform compromise.

3. Incident Response Team

The Incident Response Team ("IRT") is activated upon detection of a Sev 1 or Sev 2 incident. For Sev 3 and Sev 4 incidents, the on-call engineer and relevant team lead handle the response, escalating to the full IRT if the severity changes.

4. Detection

Rymeda employs multiple layers of detection to identify security and privacy incidents as early as possible:

5. Containment

The goal of containment is to limit the scope and impact of the incident while preserving evidence for investigation. Containment actions are authorized by the IR Lead (Sev 2–4) or Executive Sponsor (Sev 1).

6. Eradication

Eradication eliminates the root cause of the incident from the environment:

• Root cause analysis: Conduct thorough forensic investigation using audit logs, system logs, AWS CloudTrail, VPC Flow Logs, and application-level telemetry to identify the vulnerability, misconfiguration, or process failure that enabled the incident.
• Vulnerability remediation: Patch the specific vulnerability or close the misconfiguration. Update infrastructure-as-code configurations. Apply changes through the standard deployment pipeline with expedited review.
• Malware removal: If malware is identified, perform forensic imaging of affected systems, remove all malicious artifacts, and rebuild systems from known-good state. Verify integrity using checksums and behavioral analysis.
• Unauthorized access removal: Remove all unauthorized accounts, backdoors, persistence mechanisms, and lateral movement paths. Verify that no residual unauthorized access remains.
• Access review: Conduct an emergency access review for all staff with access to affected systems using the platform's access review system (which tracks reviewer, staff member, review period, current access, and recommended changes). Verify all access levels are appropriate.

7. Recovery

Recovery restores affected systems and services to full operational status:

8. Post-Incident Review

A post-incident review (blameless post-mortem) is conducted after every Sev 1 and Sev 2 incident, and for Sev 3 incidents at the IR Lead's discretion.

9. HIPAA Breach Integration

When an incident involves PHI or ePHI, the incident response process integrates with the Breach Notification Policy:

• Immediate classification: Any incident involving confirmed or suspected unauthorized access to PHI is classified as Sev 1 (confirmed breach) or Sev 2 (suspected exposure).
• Four-factor risk assessment: The Privacy Officer initiates the four-factor risk assessment per 45 CFR §164.402(2) within twenty-four (24) hours of PHI incident confirmation. The assessment must be completed within five (5) business days.
• Breach determination: Based on the risk assessment, the Privacy Officer determines whether the incident constitutes a reportable breach under HIPAA.
• Notification triggers: If a breach is confirmed, the notification timelines in the Breach Notification Policy are activated from the date of discovery (not the date of breach determination).
• Covered Entity notification: Rymeda notifies the affected Covered Entity within thirty (30) days of discovery, per the BAA.
• Documentation: All PHI-related incidents are documented in the breach log with a minimum six (6) year retention period per 45 CFR §164.530(j).

10. California Dual-Track Notification

For incidents affecting California residents, Rymeda must comply with both federal HIPAA notification requirements and California state requirements, which may have shorter timelines:

The Privacy Officer and Legal Counsel maintain a notification checklist for each incident to ensure all deadlines are tracked. California's SB 446 thirty (30) day deadline is the most aggressive consumer notification requirement and drives the operational timeline for incidents affecting California residents. See the Breach Notification Policy for full notification procedures and content requirements.

11. Communication Templates

Rymeda maintains pre-approved communication templates for each audience and severity level. All external communications are reviewed by Legal Counsel before distribution.

12. Law Enforcement Coordination

Rymeda cooperates with law enforcement in the investigation of security incidents, subject to legal review:

• Decision authority: The decision to involve law enforcement is made by Legal Counsel and the Executive Sponsor. For Sev 1 incidents involving active intrusion, ransomware, or confirmed criminal activity, law enforcement is contacted as part of the standard response.
• Evidence preservation: Rymeda preserves all forensic evidence in accordance with Section 14, including maintaining chain of custody documentation suitable for legal proceedings.
• Notification delay: If law enforcement requests a delay in breach notification, Rymeda complies in accordance with 45 CFR §164.412 (written request for specified period; oral request for up to thirty (30) days). See the Breach Notification Policy Section 11.
• FBI and IC3: For cyber incidents involving significant financial loss or infrastructure compromise, Rymeda may file reports with the FBI Internet Crime Complaint Center (IC3).

13. Insurance Notification

Rymeda maintains cyber liability insurance to cover costs associated with security incidents, including breach notification, forensic investigation, legal fees, regulatory fines, and credit monitoring services.

• Sev 1 and Sev 2: The cyber insurance carrier must be notified within twenty-four (24) hours of incident confirmation. Legal Counsel coordinates the notification.
• Sev 3: Notification to the carrier at Legal Counsel's discretion, depending on potential exposure.
• Carrier resources: The insurance carrier may provide access to pre-approved forensic investigators, breach response counsel, notification vendors, and credit monitoring services. These resources are coordinated through Legal Counsel.

14. Evidence Preservation

Evidence preservation is critical for forensic investigation, regulatory compliance, and potential legal proceedings:

• Forensic imaging: Create forensic images of affected systems before any containment or remediation actions that may alter system state. Store images in a secure, access-controlled location separate from production systems.
• Log preservation: Export and preserve all relevant audit logs, system logs, network logs, and application logs. Platform audit logs are immutable and append-only by design. Audit log exports are themselves logged (recording the exporter, filters applied, and entry count).
• Chain of custody: Maintain documented chain of custody for all evidence, including who collected it, when, how it was stored, and who has accessed it. Evidence is stored with write-protection and integrity verification (checksums).
• Retention: Incident evidence is retained for a minimum of six (6) years from the date of collection, consistent with HIPAA record retention requirements (45 CFR §164.530(j)). Evidence related to ongoing legal proceedings is retained indefinitely under legal hold.
• Trust & safety evidence: All trust and safety actions (account locks, suspensions, bans, moderation decisions) are preserved in dedicated audit logs with actor ID, actor email, action, resource type, resource ID, before/after state, reason, IP address, severity, and timestamp.

15. Tabletop Exercises and Testing

Rymeda conducts regular testing of this Incident Response Plan to ensure readiness:

16. Plan Maintenance

This IRP is reviewed and updated:

• At least annually as part of the overall security program review.
• After every Sev 1 or Sev 2 incident, incorporating lessons learned from the post-incident review.
• When there are material changes to applicable laws or regulations (e.g., HIPAA, CCPA/CPRA, California breach notification laws).
• When there are significant changes to Rymeda's infrastructure, services, or subprocessor relationships.
• After tabletop exercises or simulations identify gaps or improvement opportunities.

Changes to this IRP are approved by the IR Lead, Privacy Officer, and Executive Sponsor. All IRT members are notified of changes and required to acknowledge the updated plan.

17. Contact Information

To report a security incident or for questions about this plan:

• Security Team (24/7): security@rymeda.com
• Privacy Officer: legal@rymeda.com
• Legal Department: legal@rymeda.com
• Compliance Office: legal@rymeda.com

This plan should be read in conjunction with the Breach Notification Policy, Business Associate Agreement, Data Processing Agreement, Security page, Service Level Agreement, and Privacy Policy.