What is the first step when you suspect a security incident involving Phreesia data?

• A. Contain the incident, document details, and notify your security/compliance team or Phreesia support as per policy
• B. Ignore it
• C. Delete data
• D. Report to marketing

Answer: (A)

When you suspect a security incident involving Phreesia data, the immediate priority is a quick, coordinated response that limits damage and preserves evidence. The first step is to contain the incident, document details, and notify your security/compliance team or Phreesia support as per policy. Containment stops further access or data exposure while you assess scope. Documenting what happened—what was observed, which systems were affected, what data types are involved, which user accounts were impacted, and the actions taken—provides a clear, traceable record for investigators and for any required reporting. Notifying the designated teams or Phreesia support per policy ensures the right experts are engaged and that the response follows established procedures and regulatory obligations. Ignoring the issue, deleting data, or routing the alert to marketing would neither curb the incident nor support proper investigation and containment.