Have you developed a procedure for how your organization will report security incidents? Don't stop there! You should document all communication within your organization about security incidents.
Use the following form, prepared by Greg Jones at the SANS Institute, to help you develop a system to track your organization's responses to security incidents. This type of record is vital in the face of a security breach, or a HIPAA violation.