The basics of the HIPAA breach notification rule are these. An unpermitted use or disclosure of unsecured PHI is presumed a breach unless a four-factor risk assessment shows a low probability of compromise. Covered entities then notify individuals within 60 days of discovery, plus HHS and sometimes the media. Vendors must report breaches to their covered entity.
What counts as a breach of unsecured PHI?
A breach under HIPAA is the acquisition, access, use or disclosure of protected health information in a way the Privacy Rule does not permit, which compromises its security or privacy. The rule applies to unsecured PHI, meaning PHI not made unusable, unreadable or indecipherable to unauthorized people by a method HHS has specified.
The definitions are in 45 CFR 164.402 on eCFR. Three situations are excluded from the definition:
- An unintentional acquisition, access or use by a workforce member acting in good faith and within their authority, with no further impermissible use or disclosure.
- An inadvertent disclosure between two people authorized to access PHI at the same covered entity, business associate or organized health care arrangement, with no further impermissible use or disclosure.
- A disclosure where the organization has a good faith belief the recipient "would not reasonably have been able to retain such information."
Everything else that breaks the Privacy Rule starts from a presumption of breach. A scanned EOB faxed to the wrong office, an intake form emailed to the wrong patient, or a laptop of claim scans left on a train all begin there. The first steps after a fax goes astray are covered in what to do with a misdirected medical fax.
How does the four-factor breach risk assessment work?
The four-factor breach risk assessment is how an organization rebuts the presumption of breach. Under 45 CFR 164.402, it must show a low probability that the PHI was compromised, based on at least four factors. If the assessment cannot show that, notification is required.
The four factors, in the rule's words, are:
- "The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification". A page with names, member IDs and diagnosis codes weighs more than a page of de-identified figures. How de-identification works is covered in Safe Harbor vs Expert Determination.
- "The unauthorized person who used the protected health information or to whom the disclosure was made". Another covered entity bound by HIPAA is a different case from an unknown member of the public.
- "Whether the protected health information was actually acquired or viewed". A returned, unopened envelope differs from an email that was read.
- "The extent to which the risk to the protected health information has been mitigated". Written confirmation that a misdirected file was destroyed lowers risk.
Write the assessment down. 45 CFR 164.414 on eCFR puts the burden of proof on the covered entity or business associate to show that notices were sent or that the event was not a breach.
Breach notification deadlines and who gets told
After discovering a breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. It must also notify HHS, and if more than 500 residents of one state or jurisdiction are affected, prominent media outlets serving that area.
A breach counts as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it (45 CFR 164.404 on eCFR). That section requires notice "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." Sixty days is the outer limit, not a target.
The notice to individuals must be in plain language and describe what happened, what kinds of information were involved, steps people should take, what the organization is doing, and how to get in touch. Media notice follows 45 CFR 164.406 on eCFR. HHS notice follows 45 CFR 164.408 on eCFR: for 500 or more people, at the same time as the individual notices; for fewer, in a log submitted within 60 days after the end of the calendar year. 45 CFR 164.412 on eCFR lets law enforcement delay notices.
Example timeline: a lost laptop holding scanned EOBs
This scenario is fictional. A billing vendor's employee loses an unencrypted laptop holding scanned EOBs for 620 patients of one clinic, all in one state.
| Day | Event | Deadline that applies |
|---|---|---|
| Day 0 (example: March 3) | Employee reports the laptop missing to the vendor | Vendor's discovery date |
| Day 2 | Vendor tells the clinic and lists affected patients it can identify | Vendor to covered entity: no later than 60 days after discovery |
| Day 2 | Clinic learns of the breach from the vendor | Clinic's discovery date, unless the vendor counts as the clinic's agent, in which case it may be Day 0 |
| Day 20 | Clinic finishes its risk assessment; laptop unencrypted, so no low-probability finding | None; documents the result |
| Day 30 | Letters mailed to 620 patients | Individuals: no later than 60 days after discovery |
| Day 30 | Notice to media serving the state, since over 500 residents | Media: no later than 60 days after discovery |
| Day 30 | Report to HHS, since 500 or more people | HHS: at the same time as individual notices |
The Day 2 row turns on agency. Under 164.404(a)(2), a covered entity is treated as knowing of a breach when any workforce member or agent knows, with agency "determined in accordance with the federal common law of agency". Whether a vendor is an agent depends on the relationship, so the timeline shows both readings.
What a business associate must report to the covered entity
A business associate, such as a document processing vendor, must notify the covered entity after discovering a breach of unsecured PHI. The notice is due without unreasonable delay and no later than 60 calendar days after discovery, unless law enforcement delays it.
The vendor duties are in 45 CFR 164.410 on eCFR, which says the business associate must notify "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." The notice should identify, to the extent possible, each individual whose PHI was or is reasonably believed to have been involved. The vendor must also pass on other details the covered entity needs for its own notices, at the time or promptly after as they become available.
A business associate agreement can set a shorter reporting window than the rule. What those agreements typically contain is covered in what a business associate agreement is. Every Schema Care paid plan includes a BAA, and its compliance section gives the current status of each safeguard it lists.
Lost encrypted PHI: the reportable breach exception
Lost PHI that was encrypted to HHS guidance, with the key kept safe, is not "unsecured" PHI, so its loss does not trigger breach notification. The exception depends on two conditions: the encryption meets the guidance HHS published, and the key or password was not lost along with the data.
The HHS breach notification interim final rule in the Federal Register says encrypted PHI is secured only if the "confidential process or key that might enable decryption has not been breached." It advises storing decryption tools apart from the data. For data at rest it points to NIST SP 800-111; for data in motion, to NIST SP 800-52 and related guides.
In the example timeline above, a laptop with full disk encryption and a strong password not stored with it could have put the scans in the secured category, provided the encryption met the guidance. Choosing and verifying encryption for each storage layer is covered in encryption at rest for PHI.
Destroyed media are secured too: the same guidance treats paper shredded so it cannot be reconstructed, and electronic media cleared, purged or destroyed under NIST SP 800-88, as unreadable. Redaction does not count as destruction.