A patient views information that is not theirs when they sign in to the hospital's online portal. The patient calls the support center at the hospital but continues to be put on hold because other…

Evaluating visibility tools to check for tampering is an investigative step that should follow containment - continuing to run a compromised portal while investigating prolongs the active PII exposure.

Contacting a third-party handler may be a required step but is not the first action, since active data exposure must be stopped before escalation and coordination activities begin.

Disabling all access to the patient portal immediately halts the active PII disclosure, which is the highest priority when sensitive data is being exposed in real-time. This containment action protects patients from further harm and limits breach scope before investigation begins, satisfying HIPAA breach response obligations.

Reviewing logs to find code errors is a root-cause analysis activity that belongs after containment, as it does not stop the ongoing unauthorized disclosure of patient records.