What counts as a breach
A breach is an impermissible acquisition, access, use or disclosure of unsecured PHI that compromises its security or privacy. The important word is unsecured: PHI encrypted to HHS-specified standards is not unsecured, so an encrypted laptop going missing is generally not a reportable breach.
An impermissible use or disclosure is presumed to be a breach unless you demonstrate a low probability of compromise through a documented risk assessment. The burden is on you, and the demonstration has to be written down.
The four-factor assessment
| Factor | What you assess |
|---|---|
| Nature and extent of PHI | Identifiers involved and likelihood of re-identification |
| Who received it | Whether the recipient is itself obligated to protect PHI |
| Was it actually acquired or viewed | Access opportunity versus evidence of access |
| Extent of mitigation | Whether the risk was reduced, e.g. confirmed deletion |
All four, documented. A conclusion of low probability with no written analysis behind it is the version that fails in an investigation.
Who to notify, and when
| Who | When | Applies |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 days from discovery | All breaches |
| HHS — 500 or more affected | Within 60 days of discovery | Large breaches |
| HHS — fewer than 500 | Annually, within 60 days of year end | Small breaches |
| Prominent media | Within 60 days | 500+ in one state or jurisdiction |
| Business associate to covered entity | Without unreasonable delay, no later than 60 days — often far shorter by contract | BAs |
Discovery starts the clock, and discovery means the first day the breach is known or reasonably should have been known by anyone in the organization other than the person who caused it. That is earlier than most incident timelines assume.
What business associates owe
You notify the covered entity, not the individuals. HIPAA's outer limit is 60 days, but most BAAs impose far shorter windows — 24 or 48 hours is common, because your customer needs time to meet their own 60-day deadline.
Check what you signed. A 24-hour contractual notification obligation requires detection capability, an on-call path and a decision process that exists before the incident, not after.
What to have ready in advance
A written procedure someone could follow at 2am — who decides, who drafts, who notifies, in what order.
The four-factor template, so the assessment is consistent rather than improvised under pressure.
An incident log covering all impermissible uses, including those assessed as not breaches. The ones you decided were not breaches are exactly what an investigator asks to see.
Contact data you can actually reach affected individuals with.
Encryption where feasible. The single most effective way to keep an incident from becoming a reportable breach.
FAQs
What is a HIPAA breach?
An impermissible acquisition, access, use or disclosure of unsecured PHI that compromises its security or privacy. PHI encrypted to HHS-specified standards is not unsecured, so incidents involving properly encrypted data are generally not reportable breaches.
How long do I have to report a HIPAA breach?
Individuals must be notified without unreasonable delay and no later than 60 days from discovery. Breaches affecting 500 or more must be reported to HHS within 60 days; smaller ones annually. Business associates notify the covered entity within 60 days under HIPAA, though most BAAs impose far shorter windows.
Is every impermissible disclosure a HIPAA breach?
It is presumed to be one unless you demonstrate a low probability that PHI was compromised, through a documented four-factor risk assessment covering the nature of the PHI, who received it, whether it was actually acquired or viewed, and the extent of mitigation. The burden of demonstration is on you.
What are the four factors in a HIPAA breach risk assessment?
The nature and extent of the PHI including identifiers and re-identification risk; who the unauthorised recipient was and whether they are themselves obligated to protect PHI; whether the PHI was actually acquired or viewed rather than merely exposed; and the extent to which the risk has been mitigated.
When does the HIPAA breach clock start?
At discovery, meaning the first day the breach is known or reasonably should have been known to anyone in the organization other than the person who caused it. That is typically earlier than teams assume, because it includes the point at which the incident should have been detected.
Where to go next
See the HIPAA risk assessment, what your BAA commits you to, or HIPAA consulting.