The HIPAA Breach Notification Rule, Explained

What counts as a breach

The Breach Notification Rule lives at 45 CFR Part 164 Subpart D. The definition of breach at 164.402 is the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI.

That "compromises" phrase is the trigger. The 2013 Omnibus final rule replaced the older harm-threshold standard with a four-factor analysis. A presumption of breach applies unless the covered entity demonstrates a low probability that the PHI has been compromised through the four factors.

The four factors are:

1. The nature and extent of the PHI involved, including identifiers and likelihood of re-identification.
2. The unauthorized person who used the PHI or to whom the disclosure was made.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which the risk has been mitigated.

The analysis must be documented. If the four-factor analysis concludes there is a low probability of compromise, the incident is not a breach and no notification is required, but the analysis itself is retained for six years under 164.530(j)) and the parallel security-side retention at 164.316(b)).

When the safe harbor applies

If the PHI involved was rendered unusable, unreadable, or indecipherable per the HHS Guidance to Render Unsecured PHI Unusable — usually meaning the PHI was encrypted at the time of the incident — it is not "unsecured PHI" under 164.402 and the Breach Notification Rule does not apply. This is why endpoint and laptop encryption matter so much.

The three exclusions

Section 164.402 carves out three categories that are not breach:

1. Unintentional access by a workforce member acting in good faith within the scope of authority, with no further use or disclosure.
2. Inadvertent disclosure between two authorized people at the same covered entity or business associate, with no further use or disclosure.
3. Disclosure where the covered entity has a good-faith belief the unauthorized recipient would not reasonably have been able to retain the PHI.

Document the conclusion when one of these applies. The exclusions are narrow and OCR scrutinizes them.

Individual notice: 60 days, plain language, specific elements

45 CFR 164.404 sets the rule for notice to affected individuals. The notice must go out without unreasonable delay and in no case later than 60 calendar days from discovery. "Discovery" means the first day on which the breach is known, or should reasonably have been known, by any workforce member other than the person who committed the breach.

Required content of the notice at 164.404(c)):

• A brief description of what happened, including date of breach and date of discovery
• A description of the types of unsecured PHI involved
• Steps individuals should take to protect themselves from potential harm
• A brief description of what the covered entity is doing to investigate, mitigate, and prevent recurrence
• Contact procedures for further questions (toll-free number, email, website, or postal address)

Delivery is by first-class mail to the last known address, or by email if the individual has agreed to electronic notice. Substitute notice procedures apply when contact info is insufficient for 10 or more individuals — see 164.404(d)).

HHS Secretary notice

Two paths at 164.408:

• 500 or more individuals affected: notify the Secretary contemporaneously with the individual notice, no later than 60 days after discovery, through the HHS Breach Reporting form.
• Fewer than 500 individuals affected: log the incident and submit an annual report no later than 60 days after the end of the calendar year. The same online form is used.

Breaches affecting 500 or more individuals in a state or jurisdiction also require notice to prominent media outlets serving that area under 164.406.

Business associate obligations

A business associate that discovers a breach must notify the covered entity without unreasonable delay and in no case later than 60 days from discovery, under 164.410. The covered entity still owns the notification to individuals, HHS, and (where applicable) the media. The BAA at 164.504(e)) typically tightens the BA notice clock and assigns roles.

Law enforcement delay

164.412 permits a delay in notice when law enforcement determines that notification would impede a criminal investigation or cause damage to national security. The delay must be documented and is limited in scope.

The small-practice breach log

A defensible breach response program maintains:

• An incident intake form
• A four-factor analysis worksheet
• A notification template (individual, HHS, media as applicable)
• A breach log for fewer-than-500 incidents, queued for annual submission
• Workforce training on what to escalate and to whom
• A reconciliation against the BAA log so business associate-side incidents are captured

What OCR sees most often

OCR's published Resolution Agreements repeatedly cite:

• Late individual notice
• Late HHS notice
• Absent or inadequate four-factor analysis
• No documented mitigation
• No prior risk analysis identifying the asset that was breached

The Breach Notification Rule is a documentation exercise on top of an underlying privacy and security program. The notice itself is not the deliverable; the deliverable is the full record of the analysis, the notification, and the corrective action.

Restraint about claims

No vendor tool or playbook prevents breaches in absolute terms. Encryption and good controls reduce the probability and the consequences. A practice's job is to maintain the program, document the response, and learn from each incident.

How D3rx fits

D3rx SRA Binder Studio includes the breach-incident workflow, the four-factor analysis worksheet, the fewer-than-500 log, and references back to the HHS notification portal. It is a point-in-time administrative documentation aid; the practice remains responsible for the substance of every analysis and notification.

Next steps

See where your practice currently stands with the free 5-question readiness check, or review the full workflow and pricing on the main SRA page.