Purpose
This Policy establishes the framework for identifying, investigating, containing, mitigating, documenting, and reporting actual or suspected security incidents affecting SiriON. It is intended to protect patient and practitioner information, preserve system availability, minimize operational disruption, support legal compliance, and ensure timely notification and remediation.
Scope
This Policy applies to SiriON mobile applications, Supabase infrastructure, AWS cloud storage, local SQLite databases, synchronization systems, clinical media repositories, authentication systems, audit logging systems, consent management systems, and third-party service providers, as well as employees, founders, contractors, consultants, vendors, and authorized service providers.
Definitions
Security Incident: Any actual or suspected event that compromises confidentiality, integrity, availability, violates security policies, or threatens patient or practitioner information.
Personal Data Breach: A breach involving accidental disclosure, unauthorized disclosure, unauthorized access, loss, destruction, alteration, or misuse of personal data.
Clinical Data Incident: Any incident affecting patient records, clinical notes, appointments, photographs, radiographs, treatment records, or academic logbooks.
Classification
Critical: Database compromise, clinical photograph exposure, mass patient data disclosure, credential theft affecting multiple users, ransomware, or unauthorized administrator access.
High: Single-account compromise, unauthorized clinical record access, cloud bucket exposure, or authentication bypass.
Moderate: Failed security controls, suspicious access patterns, or sync anomalies.
Low: Minor configuration errors, security warnings, or isolated failed login events.
IRT
The Incident Response Team includes an Incident Commander, Compliance Officer, Technical Lead, Communications Lead, and Legal Advisor.
Lifecycle
SiriON follows six stages: preparation, detection, containment, investigation, recovery, and post-incident review.
Preparation
SiriON maintains audit logging, access monitoring, security alerts, encryption controls, backup systems, disaster recovery procedures, and vendor management procedures.
Detection
Incidents may be detected through audit logs, authentication logs, synchronization logs, monitoring systems, user reports, vendor notifications, security scans, or regulatory notifications. All suspected incidents are documented immediately.
Registration
Upon detection, SiriON creates an Incident Record containing an incident ID, date and time, reporter, severity classification, systems affected, data categories affected, and initial assessment.
Containment
Reasonable containment measures may include account suspension, credential resets, API key rotation, database access restrictions, temporary service suspension, network isolation, and vendor escalation, with protection of patient information as the priority.
Preservation
Before remediation, SiriON preserves system logs, access logs, authentication records, synchronization records, database audit trails, consent records, and legal acceptance records. Evidence is protected from modification.
Investigation
The investigation determines root cause, systems affected, information affected, duration of exposure, number of affected users, likelihood of misuse, and regulatory implications. Findings are documented.
Breach Assessment
SiriON assesses whether the incident is a security incident only or a personal data breach under applicable law, considering the type, sensitivity, volume, likelihood of harm, and potential misuse of information.
Notifications
Where a personal data breach is identified, SiriON undertakes notification activities in accordance with applicable legal requirements and may notify affected Data Principals, competent authorities, the Data Protection Board of India, or other authorities where required.
Data Principal Notice
Where notification is required, SiriON provides plain-language notices describing the incident, the categories of information involved, potential impact, mitigation actions, recommended user actions, and contact information.
Communications
Only authorized personnel may communicate publicly regarding incidents. Unauthorized disclosure of incident information is prohibited.
Recovery
Recovery activities may include credential rotation, security patching, database restoration, service restoration, infrastructure hardening, and monitoring enhancements. Systems are validated before returning to normal operation.
Post-Incident Review
Within 30 days of closure, SiriON conducts a review of root cause, response effectiveness, communication effectiveness, security improvements, and policy improvements, and documents a corrective action plan.
Retention
Incident Records, Investigation Reports, Breach Assessments, Notification Records, Forensic Evidence, and Regulatory Correspondence are retained for 3 years, or longer where required by law.
Vendor Incidents
Where a third-party provider experiences a security incident affecting SiriON data, SiriON assesses impact, coordinates investigation, requests remediation details, determines notification obligations, and documents actions taken.
Training
Incident response procedures are reviewed periodically, and tabletop exercises or simulated incident drills may be conducted to evaluate readiness.
Policy Review
This Policy is reviewed at least annually or following material security incidents, significant infrastructure changes, changes in applicable law, or regulatory guidance.
Contact
Privacy & Compliance Office, SiriON Health. Email: privacy@sirionhealth.com. Security Reports: security@sirionhealth.com.
Approval
This Policy is approved by SiriON Health management and forms part of the organization’s information security and data protection governance framework.