What Is the HIPAA Breach Notification Rule?

The HIPAA Breach Notification Rule, in 45 CFR 164.400 to 164.414, requires covered entities and business associates to give notice after the discovery of a breach of unsecured protected health information. Under HIPAA, a breach is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under the Privacy Rule that compromises the security or privacy of the information. Unsecured protected health information is information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through a technology or methodology specified in HHS guidance (45 CFR 164.402).

The definition has three exclusions. These are an unintentional acquisition, access, or use made in good faith by a workforce member within the scope of authority, an inadvertent disclosure between persons authorized to access the information at the same covered entity, business associate, or organized health care arrangement, and a disclosure where the covered entity or business associate has a good faith belief that the unauthorized recipient would not reasonably have been able to retain the information. Other impermissible uses or disclosures are presumed to be breaches unless a risk assessment shows a low probability that the information has been compromised. The assessment considers at least the nature and extent of the information, the unauthorized person involved, whether the information was actually acquired or viewed, and the extent to which the risk has been mitigated (45 CFR 164.402).

A covered entity notifies each affected individual without unreasonable delay and no later than 60 calendar days after discovery. Written notice goes by first-class mail, or by email if the individual has agreed to electronic notice, and the rule also provides for substitute notice when contact information is insufficient or out of date and for telephone notice in urgent situations (45 CFR 164.404). A breach involving more than 500 residents of a State or jurisdiction also requires notice to prominent media outlets serving that area (45 CFR 164.406). For breaches involving 500 or more individuals, the covered entity notifies HHS contemporaneously with the individual notices. Smaller breaches are logged and reported to HHS no later than 60 days after the end of each calendar year (45 CFR 164.408).

A business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410). If a law enforcement official states that notice would impede a criminal investigation or damage national security, notice is delayed for the period specified in a written statement, or for no longer than 30 days after an oral statement unless a written statement is submitted during that time (45 CFR 164.412). The covered entity or business associate carries the burden of showing that notices were made or that no breach occurred (45 CFR 164.414).