A Loss Formula for Estimating the Cost of a PHI Leak Through an LLM Prompt

The formula

The estimate treats a PHI leak through an LLM prompt as an expected loss. Multiply the annual frequency of leak events by the combined cost of a single event, built from six components.

Keeping the cost of a single event separate from how often events occur lets you change one input at a time and see how the total responds.

What each variable needs

The six cost components are:

• Detection and containment
• Notification
• Regulatory
• Legal
• Provider remediation
• Operational disruption

Each component depends on one or more of four inputs: record count, detection time, provider retention, or severity. Define each variable and state your assumptions before you calculate, so the result can be reviewed and reproduced.

Mapping variables to control points in the request path

Runtime controls reduce the terms they act on. To compare a control's value to its cost, identify which variable it affects and where in the request path it operates.

Loss formula variables and where they are controlled

Worked example with explicit assumptions

A worked example applies the formula end to end. Each assumption is stated explicitly, so you can replace it with a value from your own environment and see how the expected loss changes.

Sourcing inputs and handling HIPAA uncertainty

Define each variable, state where its value comes from, and record any assumption you cannot confirm. Where HIPAA uncertainty affects an input, state it as an assumption in the model rather than leaving it implicit.

Using the output to evaluate control investment

Because runtime controls reduce the terms they act on, you can recalculate the expected loss with a control in place and compare the reduction to the control's cost.