Breach Notification Rule

For large-scale breaches affecting more than 500 residents of a single state or jurisdiction, the covered entity must issue a prominent media notification.

• Trigger: The breach impacts 500 or more individuals within a specific state, territory, or possession.
• Deadline: Without unreasonable delay, and in no case later than 60 calendar days after discovery of the breach.
• Method: A press release distributed to prominent media outlets serving the affected geographic area. This ensures individuals who may not be reachable by mail are still informed.

A business associate that discovers a breach of unsecured PHI at or by the business associate is required to notify the covered entity.

• Deadline: Without unreasonable delay, and in no case later than 60 calendar days after discovery of the breach.
• Required Content: The notification must, to the extent possible, identify each individual whose unsecured PHI has been breached. The business associate must also provide any other available information the covered entity is required to include in its own individual notice.
• Contractual Flow: This obligation is typically reinforced within the Business Associate Agreement (BAA) governing the relationship.

An impermissible access, use, or disclosure of PHI is presumed to be a breach unless the covered entity or business associate demonstrates that there is a low probability that the PHI has been compromised.

• Four-Factor Risk Assessment: This determination must be based on a documented assessment of at least these four factors:
  • The nature and extent of the PHI involved, including the types of identifiers and likelihood of re-identification.
  • The unauthorized person who used the PHI or to whom the disclosure was made.
  • Whether the PHI was actually acquired or viewed.
  • The extent to which the risk to the PHI has been mitigated.
• Documentation: The entity bears the burden of proof and must maintain thorough documentation of the risk assessment to demonstrate compliance.

The notification obligations are triggered specifically by a breach of unsecured protected health information. Understanding this term is critical.

• Unsecured PHI: PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary of HHS.
• Securing PHI (Safe Harbor): The only two methods that render PHI secure and exempt from notification are:
  • Encryption: For data at rest and in transit, using algorithms like AES-256.
  • Destruction: Secure destruction of the physical media on which the PHI was stored, such as paper shredding or NIST-compliant digital media sanitization.
• Strategic Implication: A robust encryption strategy for ePHI at rest and in transit is the primary technical safeguard that can prevent a reportable breach event.

The Breach Notification Rule applies exclusively to unsecured protected health information—data that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons. HHS guidance specifies that PHI is considered secured only when it has been:

• Encrypted using an algorithmic process meeting NIST SP 800-111 standards
• Destroyed through shredding or degaussing of electronic media

If a laptop containing 50,000 patient records is stolen and the data was not encrypted, this constitutes a breach of unsecured PHI triggering full notification obligations.

A four-factor risk assessment determines whether an impermissible access constitutes a reportable breach. Covered entities must evaluate:

• Nature and extent of PHI involved—does it include sensitive diagnoses or financial data?
• The unauthorized person—was it an internal employee who immediately deleted the data?
• Whether PHI was actually acquired or viewed—forensic evidence matters
• Extent of mitigation—has the recipient provided satisfactory assurances of destruction?

If any single factor indicates low probability of compromise, the incident is not a notifiable breach. This assessment must be thoroughly documented.

The Rule imposes strict, non-negotiable deadlines once a breach is confirmed:

• Individual notice: Without unreasonable delay, but no later than 60 calendar days from breach discovery
• HHS Secretary notice: For breaches affecting 500+ individuals, notification must occur contemporaneously with individual notice; for breaches affecting fewer than 500, an annual log submission is permitted
• Media notice: Required for breaches affecting 500+ residents of a single state or jurisdiction—must be issued to prominent media outlets in that area

Failure to meet the 60-day individual notification deadline is one of the most commonly cited HIPAA violations.

Under the Omnibus Final Rule, business associates bear direct liability for breach notification. Key requirements:

• Discovery triggers a 60-day clock: The BA must notify the covered entity immediately, but no later than 60 days from discovering the breach
• BA must identify affected individuals: The BA must provide the covered entity with sufficient information to identify each affected individual, enabling the CE to fulfill its own notification duties
• Subcontractor chain: If a BA's subcontractor experiences a breach, the subcontractor must notify the BA, who then notifies the CE—creating a cascading notification chain

This direct liability eliminates the prior ambiguity where BAs could deflect responsibility to the covered entity.

Individual notification letters must contain specific elements prescribed by the Rule:

• Brief description of the breach: What happened, including the date or date range
• Types of PHI involved: Specify categories like names, SSNs, diagnoses, or treatment dates—be specific without revealing the actual data
• Steps individuals should take: Recommend credit monitoring, fraud alerts, or contacting insurers
• What the covered entity is doing: Describe investigation status, mitigation actions, and safeguards implemented to prevent recurrence
• Contact procedures: Include a toll-free number, email, or website where individuals can inquire about the breach

Letters must be written in plain language and delivered by first-class mail or email if the individual has agreed to electronic notice.

The covered entity bears the burden of demonstrating that all required notifications were made or that an impermissible use did not constitute a breach. This creates critical documentation obligations:

• Risk assessments must be preserved: If the four-factor assessment concluded low probability of compromise, the rationale must be fully documented and defensible under audit
• Notification records: Copies of all individual, media, and HHS notices must be maintained as part of the designated record set
• Presumption of breach: Any impermissible access, use, or disclosure is presumed to be a breach unless the covered entity can demonstrate low probability of compromise

This evidentiary burden makes thorough forensic investigation and legal documentation essential before concluding an incident is not reportable.