Report a security incident with Health app data Share with Provider
In case of a security incident that may impact the Health app data Share with Provider technology or that involves data obtained through Health app data Share with Provider, contact the Apple Information Security team at:
Important: Do not include personally identifiable information or protected health information in your communications.
Information to include in your initial report
Include “Health app data Share with Provider” in the subject line, and provide the following information to the best of your ability.
[Your organization’s name] Security Point of Contact Information
[Your organization’s name] Privacy Point of Contact Information
A brief overview of the incident
Incident start date and time
Incident end date and time (if applicable)
When was the security incident discovered (date and time)?
How was the incident identified?
Is the incident ongoing?
Is the incident contained? If so, how was it contained?
Are there any signs of persistence on your network?
Are there any signs of lateral movement in your network?
Does your organization have 2FA for VPN, WebMail, Office365, etc?
Was data obtained through the Health app data Share with Provider feature disclosed or accessed during the incident? If so, please describe the data that was potentially disclosed or accessed.
Has law enforcement or other government agency or authority been engaged or notified (for example, the U.S. Department of Health and Human Services (HHS) or a State Attorney General)? If so, which agency or authority?
Has a third-party incident response team been engaged to investigate the incident? If so, who?
Information to include in follow-up correspondence
The following information will be requested by Apple in follow-up communications:
Root Cause Analysis
What actions were taken to ensure that the incident was appropriately addressed/mitigated?
What is being done to prevent this kind of incident from occurring again?
Any relevant indicators of compromise