How the HIPAA Breach Notification Rule works

What counts as a breach under HIPAA

A breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of protected health information ¹. Such a use or disclosure is presumed to be a breach apart from where the entity shows a low probability that the information was compromised through a risk assessment ¹. Notification applies only to unsecured protected health information, meaning information not rendered unusable through encryption or destruction under HHS guidance ¹.

• The nature and extent of the protected health information involved ¹.
• The unauthorised person who used it or received the disclosure ¹.
• Whether the protected health information was actually acquired or viewed ¹.
• The extent to which the risk has been mitigated ¹.

Deadlines for notifying individuals

Section 164.404 requires individual notice without unreasonable delay and in no case later than 60 calendar days after discovery of a breach ². Notice goes by first-class mail, or by email if the individual has agreed to electronic notice ¹.

For 10 or more individuals with insufficient contact details, substitute notice is posted on the website home page for at least 90 days or placed in major print or broadcast media, with a toll-free number active for at least 90 days ¹.

Media notice and notice to the Secretary

Section 164.406 requires notice to prominent media outlets serving a State or jurisdiction when a breach affects more than 500 of its residents, within the same 60-day outer limit ².

Under section 164.408, a breach affecting 500 or more individuals is reported to the Secretary contemporaneously with the notice to individuals ². The HHS reporting guidance states the outer limit as no later than 60 calendar days from discovery, with filing through the online breach reporting portal ³. A breach affecting fewer than 500 individuals may be reported annually, not later than 60 days after the end of the calendar year in which it was discovered ^2,3. The Office for Civil Rights states on its breach portal that it investigates all breaches of protected health information and Part 2 records that affect 500 or more individuals ⁴.

Business associates

A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery under section 164.410 ¹. The business associate identifies each affected individual to the extent possible and provides the other information the covered entity needs for its own notices ¹.