Four-Factor Breach Risk Assessment
The four-factor analysis at 45 CFR 164.402 used to determine whether an impermissible use or disclosure of PHI is a reportable breach.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- HIPAA & Privacy
- Primary sources
- 3
- Workspace handoff
- compliance binder →
Where this comes up
Privacy officers and practice managers handle this — patient rights requests, accounting of disclosures, BAA reviews with new vendors, breach risk assessments after an incident, and OCR responses when a complaint lands. The 60-day breach-notification clock starts at discovery, not at investigation close.
Full definition
What it is in practice
45 CFR 164.402 requires consideration of: (1) the nature and extent of PHI involved, (2) the unauthorized person who used or received it, (3) whether the PHI was actually acquired or viewed, and (4) the extent to which the risk has been mitigated. If the analysis demonstrates a low probability of PHI compromise, notification is not required.
How it shows up in your practice
The analysis must be documented in writing for every potential breach, even those determined not to be reportable. Keep these records for at least six years per 45 CFR 164.530(j).
Sources
- 45 CFR 164.402 — Breach definitionshttps://www.ecfr.gov/current/title-45/section-164.402
- 45 CFR 164.530 — Privacy Rule administrative requirementshttps://www.ecfr.gov/current/title-45/section-164.530
- HHS — Breach Notification Rulehttps://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
Document the four-factor analysis in the Compliance Binder
Open compliance binder →Related terms
- HIPAA & PrivacyBreach of Unsecured PHIAn impermissible use or disclosure of PHI that is presumed to be a breach unless a four-factor risk assessment shows a low probability that PHI was compromised.
- HIPAA & PrivacyHIPAA Breach Notification RuleThe federal rule at 45 CFR Part 164 Subpart D requiring covered entities and business associates to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI.
- SecurityIncident Response PlanThe documented plan describing how a covered entity detects, contains, eradicates, and recovers from a security incident.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryBreach of Unsecured PHIAn impermissible use or disclosure of PHI that is presumed to be a breach unless a four-factor risk assessment shows a low probability that PHI was compromised.
- GlossaryHIPAA Breach Notification RuleThe federal rule at 45 CFR Part 164 Subpart D requiring covered entities and business associates to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI.
- GlossaryIncident Response PlanThe documented plan describing how a covered entity detects, contains, eradicates, and recovers from a security incident.
- RegulationHIPAA Breach Notification Rule Overview (45 CFR 164.400-414)When unsecured PHI is accessed, used, or disclosed in a manner not permitted, the entity must follow individual, HHS, and (in some cases) media notification requirements within defined timelines.
- GlossaryHIPAA Privacy RuleThe federal regulation at 45 CFR Part 164 Subpart E that governs the use and disclosure of PHI.
- GlossaryNotice of Privacy PracticesThe written notice covered entities must provide to patients describing how PHI may be used and disclosed and patient rights regarding PHI.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.