Incident option lists — cause, PI-category, harm, containment, remediation, and notification taxonomies
Last updated: October 20, 2026 by Steve
Incident Option Lists
Incident option lists are the configurable taxonomies that populate the dropdowns and multi-selects on a privacy incident — the causes, personal-information categories, harm types, containment and remediation measure types, and notification types staff choose from as they document a breach. The Settings UI groups these as choice fields, and editing them here changes the vocabulary available throughout the Incidents module.
Where to Find It
Open Settings from the app toolbar and choose Incident option lists in the Incidents & complaints group. This group is visible only to users who hold the relevant privacy configure permission.
The Lists
| List | Where it appears | Notes |
|---|---|---|
| Cause types | The Cause type field on the Report dialog and Overview tab | Classifies what caused the incident, alongside the free-text cause narrative. |
| PI categories | Categories of personal information involved on Overview | Categories flagged sensitive display a red shield on the record. |
| Harm types | Types of harm on Overview | Records the kinds of harm the breach could cause. |
| Containment measure types | The type field on a containment measure | Classifies actions taken to stop or limit the breach. |
| Remediation measure types | The type field on a remediation measure | Classifies corrective and preventive actions. |
| Notification types | The Add notification picker on the Notifications tab | Scoped to the incident's governing legal authority; used for voluntary notices. |
Breach Classification Is Not Edited Here
For a breach, the incident's Overview records a Nature of breach and a Circumstance, which are how a regulator's annual breach statistics count it. The nature is stolen, lost, used without authority, disclosed without authority, or collected without authority through the electronic health record, and each nature offers its own circumstances (for example, for a theft: an internal party, a stranger, ransomware, another cyberattack, unencrypted portable equipment, paper records or something else). These follow the regulator's form, so they are fixed and are not edited on this page. They are separate from your own Cause types above, which describe what happened in your organization's words. The Ontario packs' annual privacy breach statistics read them, and each report's Before filing section counts the breaches still missing a classification. See Incident details.
How It Affects Incidents
- Cause, PI categories, and harm types are chosen on the Report dialog or the Overview tab and become part of the incident's factual record.
- Marking a PI category sensitive is what surfaces the red shield when that category is selected on an incident.
- Containment and remediation measure types populate the type dropdown on the shared measure panel opened from those tabs.
- Notification types appear when logging a voluntary notice; the list is filtered to the incident's legal authority.
Best Practice
Keep each list short and mutually distinct. Reserve the sensitive flag on PI categories for genuinely sensitive information — selecting one raises a red shield on the incident, so over-flagging dilutes the signal.