Executing HIPAA Breach Notification

Executing HIPAA Breach Notification

Overview

The HIPAA Breach Notification Rule (45 CFR §§164.400-414) requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information (PHI). This skill covers the complete HIPAA breach notification workflow, including the four-factor risk assessment, individual notification requirements, HHS/OCR reporting obligations, state attorney general notification, and media notification thresholds.

Key Definitions

Four-Factor Breach Risk Assessment — 45 CFR §164.402(2)

A covered entity must assess the probability that PHI has been compromised using four factors:

Factor 1: Nature and Extent of PHI Involved

• What types of identifiers were involved? (name, SSN, date of birth, diagnosis codes, treatment records)
• How many records were involved?
• Does the PHI include information that increases the risk of identity theft or financial fraud (SSN, financial information)?
• Does the PHI include clinical information that could cause stigma or embarrassment (mental health, substance abuse, HIV status, reproductive health)?

Factor 2: Unauthorized Person Who Used or Received the PHI

• Was the recipient another covered entity or business associate bound by HIPAA?
• Was the recipient a person with no obligation to protect the PHI?
• Is the recipient known or unknown?
• Does the recipient have the ability to re-identify de-identified data?

Factor 3: Whether the PHI Was Actually Acquired or Viewed

• Is there evidence the PHI was actually accessed or viewed?
• Was the PHI returned unopened (e.g., misdirected mail returned by postal service)?
• Do forensic logs show the data was downloaded, copied, or transmitted?
• Was the exposure theoretical (e.g., server was accessible but no evidence of access)?

Factor 4: Extent to Which Risk Has Been Mitigated

• Was the PHI recovered or destroyed?
• Did the unauthorized recipient provide assurances (written attestation) of destruction?
• Were technical controls in place that limited access (password-protected files, short exposure window)?
• Has the covered entity obtained confirmation that the PHI was not further disclosed?

Assessment Outcome

If the four-factor assessment demonstrates a low probability that the PHI has been compromised, the incident is not a reportable breach. The assessment must be documented. If there is any doubt, the incident should be treated as a reportable breach.

Notification Requirements

Individual Notification — 45 CFR §164.404

HHS/OCR Notification — 45 CFR §164.408

State Attorney General Notification — 45 CFR §164.412

Media Notification — 45 CFR §164.406

Breach Exceptions — 45 CFR §164.402(1)

Three exceptions to the definition of "breach" (not reportable even if unsecured PHI is involved):

Exception 1: Unintentional Acquisition

Good-faith, unintentional acquisition, access, or use of PHI by a workforce member or person acting under the covered entity's authority, if made within the scope of authority and without further impermissible use or disclosure.

Exception 2: Inadvertent Disclosure Within Organization

Inadvertent disclosure of PHI by a person authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the same entity, and the PHI is not further used or disclosed impermissibly.

Exception 3: Good Faith Belief of No Retention

Disclosure of PHI where the covered entity or business associate has a good-faith belief that the unauthorized person would not reasonably have been able to retain the information.

Business Associate Obligations — 45 CFR §164.410

1. Business associate must notify the covered entity of a breach without unreasonable delay, and no later than 60 days from discovery (or a shorter period specified in the BAA).
2. The notification must include: identification of each individual affected (if known), and any other available information the covered entity needs to provide individual notification.
3. The covered entity is ultimately responsible for providing all required notifications.

Penalties for Non-Compliance

(Penalty amounts adjusted for inflation per Federal Register notice, effective 2025.)

Integration with State Laws

HIPAA breach notification does not preempt state breach notification laws that provide greater protection or additional requirements. Covered entities must comply with both HIPAA and applicable state laws. In practice:

• HIPAA 60-day deadline is the outer limit; some states impose shorter deadlines.
• State content requirements may exceed HIPAA minimums.
• State AG notification may be required even for breaches under 500 individuals depending on state law.