Hipaa Breach Notify

HIPAA Breach Notification Rule — 45 CFR §164.400-414

Overview

The HIPAA Breach Notification Rule, added by the HITECH Act of 2009 and finalized in the Omnibus Rule of 2013 (78 FR 5566), requires covered entities and business associates to provide notification following a breach of unsecured protected health information (PHI). The rule establishes specific timeframes, content requirements, and reporting obligations that vary based on the number of individuals affected. Post-2013, the rule applies a presumption that any impermissible acquisition, access, use, or disclosure of PHI is a breach unless the covered entity demonstrates through a risk assessment that there is a low probability the PHI was compromised.

Definition of Breach — §164.402

What Constitutes a Breach

A breach is the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule that compromises the security or privacy of the PHI.

Presumption of Breach

Under the 2013 Omnibus Rule, an impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity or business associate demonstrates through a four-factor risk assessment that there is a low probability that the PHI has been compromised.

Four-Factor Risk Assessment — §164.402(2)

If the risk assessment demonstrates low probability of compromise across all four factors, the incident is not a breach and notification is not required. The assessment must be documented regardless of the conclusion.

Exceptions to the Breach Definition — §164.402(1)

Three circumstances are excluded from the definition of breach:

1. Unintentional good-faith acquisition: PHI acquired unintentionally by a workforce member or person acting under the authority of the covered entity or BA, made in good faith and within the scope of authority, and the PHI is not further used or disclosed impermissibly
2. Inadvertent disclosure between authorized persons: PHI inadvertently disclosed by a person authorized to access PHI to another person authorized to access PHI at the same covered entity, BA, or organized healthcare arrangement, and the information is not further used or disclosed impermissibly
3. Good-faith belief of non-retention: The covered entity or BA has a good-faith belief that the unauthorized person to whom the disclosure was made would not reasonably have been able to retain the information

Unsecured PHI — §164.402

Breach notification obligations apply only to "unsecured PHI" — PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized individuals through one of the technologies specified by HHS:

Safe Harbor Technologies (HHS Guidance, 74 FR 19006)

If PHI was properly encrypted and the encryption key was not compromised, or if PHI was properly destroyed, then it is "secured" and the breach notification provisions do not apply.

Notification Requirements

Individual Notification — §164.404

Who must notify: The covered entity (not the business associate directly, unless delegated by the BA agreement).

Timeframe: Without unreasonable delay, and no later than 60 calendar days from the date of discovery of the breach. Discovery occurs on the first day the breach is known or, by exercising reasonable diligence, would have been known. Knowledge of a workforce member or agent is imputed to the covered entity.

Method: Written notice by first-class mail to the individual's last known address (or next of kin if deceased). Email is permitted if the individual has agreed to electronic notice. If contact information is insufficient or out of date for 10 or more individuals, a conspicuous posting on the covered entity's website for 90 days or a notice in major print or broadcast media is required.

Content requirements (§164.404(c)):

1. A brief description of what happened, including the date of the breach and the date of discovery
2. A description of the types of unsecured PHI involved (e.g., name, SSN, date of birth, diagnosis, treatment information — do not include the actual PHI)
3. Steps individuals should take to protect themselves from potential harm
4. A brief description of what the covered entity is doing to investigate, mitigate harm, and prevent future breaches
5. Contact procedures including a toll-free telephone number, email address, postal address, or website

Asclepius Health Network Individual Notice Template:

Asclepius Health Network maintains pre-approved breach notification letter templates reviewed by legal counsel, with variable fields for breach-specific details. The template includes:

• Description of the incident
• Types of information involved
• Steps Asclepius has taken (investigation, remediation, enhanced safeguards)
• Offer of complimentary credit monitoring and identity theft protection services (24 months for breaches involving SSN or financial data)
• Toll-free call center number staffed by trained representatives
• Instructions for placing fraud alerts and security freezes
• Contact information for the Asclepius Privacy Office, HHS OCR, and relevant state attorney general