HIPAA rules
When something goes wrong with PHI, the rule decides the next sixty days.
The Breach Notification Rule (45 CFR 164.400 to 164.414) turns an incident into a set of duties: assess, decide, tell the right people, and keep the record. Most of the hard calls happen in the first days, while facts are still thin. This page walks through those calls in order.
Back to HIPAA services01 · The presumption
Every impermissible use starts as a breach
You must prove it is not one, not the other way round.
A breach is any acquisition, access, use or disclosure of PHI that the Privacy Rule does not allow and that puts the information's security or privacy at risk. Unless you show otherwise, the rule treats every such event as a breach by default. Overturning that default takes a written assessment concluding the chance of exposure was low, and the burden of proof sits with you.
Only unsecured PHI triggers notice. PHI encrypted or destroyed in line with HHS guidance is treated as unusable to the person who got it, so losing an encrypted laptop with keys kept elsewhere is not a notifiable breach.
02 · Risk assessment
The four-factor assessment, with the questions to ask
Each factor is a question you answer in writing.
- What was exposedWhich identifiers and how sensitive the health content was. A diagnosis with a name weighs more than a visit date with a record number.
- Who got itAnother covered entity bound by HIPAA is a lower risk than an unknown party on the internet.
- Was it actually viewedLogs that show a misdirected file was never opened count in your favour.
- How far risk was reducedA credible recipient's signed promise to delete, or a fast revocation of access.
Three exceptions that are not breaches at all
- A workforce member's unintentional, good-faith access within their authority, with no further misuse.
- An inadvertent disclosure between two people both authorised at the same organisation, with no further misuse.
- A disclosure where you believe in good faith the recipient could not have retained the data.
03 · Who is told
Who is told, by whom, and how
Individuals always; HHS always; the media only above a threshold.
| Recipient | Duty and timing | How |
|---|---|---|
| Affected individuals | Covered entity; as soon as reasonably possible, and never later than 60 calendar days from the day of discovery | First-class mail, or email if the person agreed; plain language |
| People you cannot reach (10 or more) | Covered entity; same clock | Website home page notice for 90 days or major media, plus a toll-free number open 90 days |
| HHS, 500 or more affected | Covered entity; at the same time as the individual notices | The HHS breach portal |
| HHS, fewer than 500 affected | Covered entity; within 60 days after the end of the calendar year of discovery | The HHS breach portal, from your log |
| Media | Covered entity; if the event reaches over 500 people living in a single state or jurisdiction; same 60-day ceiling | Prominent outlets serving that area |
| The covered entity | Business associate; promptly, with a ceiling of 60 days counted from discovery | Written notice naming affected people where possible, plus facts for the notices |
Discovery is the first day the breach is known, or would have been with reasonable diligence, to anyone in the workforce other than the person who caused it. A law enforcement request can delay notice under 164.412. Sixty days is an outer limit, not a target.
04 · Response flow
A response flow for a vendor team
Four stages from first signal to closed file.
Contain and preserve
Stop the exposure and keep the evidence.
- What happens
- Revoke access or pull the exposed resource
- Snapshot logs before rotation
- Record the discovery date and who knew
- You get
- A timeline that starts at discovery
- Good practice
- Incident lead named within hours
- Watch for
- Deleting the exposed data before scoping it
Scope and assess
Find out what PHI, whose, and whether it was secured.
- What happens
- Query logs for records touched
- Check encryption status
- Work through the exceptions and the four factors
- You get
- A list of affected individuals per customer
- A written assessment
- Good practice
- Assessment signed by a named owner
- Watch for
- Calling it low risk without evidence
Notify
Tell each covered entity, which then tells people, HHS and media.
- What happens
- Send written notice to each affected customer
- Follow up with facts as they emerge
- Support their notices
- You get
- Dated notices on file
- Good practice
- Meeting the shorter clock in your agreement
- Watch for
- Waiting for a complete picture before the first notice
Close and learn
Fix the cause and keep the record.
- What happens
- Root-cause analysis
- Update the risk analysis
- Apply sanctions where policy requires
- You get
- A closed file kept for six years
- Good practice
- Controls changed, not just documented
- Watch for
- Closing the file without a fix
05 · Mistakes
Where breach handling usually goes wrong
Most errors are about time and paper.
- Starting the clock late. Counting from when legal was told, rather than when an engineer first saw the alert.
- Treating 60 days as the target. Notice is due without unreasonable delay; waiting with facts in hand is itself a failure.
- No written assessment. Deciding a breach is low risk in a chat thread, with nothing on file to rebut the presumption.
- Assuming encryption saved you. Encryption only helps if the keys were not exposed with the data.
- Ignoring the contract. Many agreements set a much shorter vendor notice window than the regulation.
- Forgetting the small ones. Breaches under 500 people still go in the log and to HHS each year.
Sources: 45 CFR 164.400 to 164.414 (Breach Notification Rule: definitions, notices to individuals, media and HHS, business associate notice, law enforcement delay, burden of proof); 45 CFR 164.530(j) (retention); HHS guidance on rendering PHI unusable, unreadable or indecipherable; HITECH Act section 13402 as summarised by HHS.
Breach notification questions
Is a ransomware attack a breach?
Presume so unless the assessment shows low probability of compromise.
HHS guidance treats encryption of PHI by ransomware as an unauthorised acquisition, so the presumption applies. You may still rebut it with a documented four-factor assessment, for example if forensics show data was not taken and the data was itself encrypted.
Do we, as a vendor, notify patients ourselves?
Usually not. You notify the covered entity.
The rule puts individual, HHS and media notice on the covered entity. A vendor's own duty is to report the incident up to the customer it serves. Your agreement may delegate the patient notices to you, in which case you follow the same content and timing rules.
Does an email sent to the wrong clinic count?
It is an impermissible disclosure; assess it.
If the recipient is another HIPAA-covered organisation that confirms it deleted the message unread, the four factors may well show a low probability of compromise. Write that down, with the confirmation attached.
How long must breach records be kept?
Six years.
Notices, assessments and the reasoning behind a decision not to notify fall under the Privacy Rule's six-year documentation duty. State law may add its own duties on top.
Rehearse the first week before you need it.
We test your incident plan against the Breach Notification Rule and your customer agreements. Counsel should confirm notice duties for any real incident.