The HIPAA Breach Notification Rule, at 45 CFR § 164.402, requires determining whether unsecured protected health information was compromised after an incident. It presumes any acquisition, access, use, or disclosure of unsecured PHI not permitted by the Privacy Rule is a breach unless the covered entity or business associate demonstrates a low probability of compromise through a four-factor risk assessment. That assessment weighs the nature and extent of the PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and the extent of risk mitigation.
The four-factor risk assessment mechanism
The Breach Notification Rule, issued by HHS under authority in the HITECH Act, does not ban every impermissible touch of health data. It creates a rebuttable presumption: any impermissible acquisition, access, use, or disclosure of unsecured PHI is a breach unless the entity proves low probability that the PHI was compromised. "Compromised" is the operative word. It means the data was actually exposed in a way that creates meaningful risk of harm, not merely that a policy failed. The difference matters because "breach" triggers notification duties, while a documented low-probability determination does not.
The four factors are cumulative, not a checklist where two of four pass. Factor one examines the nature and extent of the PHI involved, including identifiers and the likelihood of re-identification. Factor two examines the unauthorized person who used or received the PHI. Factor three asks whether the PHI was actually acquired or viewed, as opposed to merely accessible. Factor four examines the extent to which risk has been mitigated, such as a recipient's signed destruction attestation.
Factor three carries disproportionate weight in practice. HHS guidance frames the assessment around whether the impermissible use or disclosure compromised the security or privacy of the PHI. A laptop stolen with full-disk encryption engaged may involve no unsecured PHI at all, because the data is unusable and unreadable. The same laptop with an unencrypted drive shifts the analysis to factors one and three: what was on it, and did the thief actually reach the files?
Plain language: the rule asks whether a reasonable assessor would conclude the data was actually put at risk, not whether a safeguard failed.
Quantified context: notification clocks and safe harbors
The rule's deadlines are unforgiving once a breach is established. A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Discovery is deemed to occur when the incident is known or would have been known by exercising reasonable diligence, not when the investigation concludes. Notification to HHS follows the same 60-day outer limit. If a breach affects 500 or more residents of a state or jurisdiction, media notice is also required, and large breaches are posted on the HHS breach portal.
The encryption safe harbor is the highest-leverage provision. HHS guidance states that PHI is "unsecured" only when it is not rendered unusable, unreadable, or indecipherable to unauthorized persons through a technology or methodology specified by the Secretary. Properly implemented encryption, or destruction consistent with HHS guidance, removes the data from the rule entirely. A stolen encrypted device with a strong key is generally a reportable security incident internally but not a reportable breach externally.
Business associates operate under a parallel clock. Under 45 CFR § 164.410, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery. The covered entity's own 60-day clock does not wait for the business associate's report in every scenario, which is why contracts should require faster notice.
Timeline of the incident response and assessment sequence
| Stage | Typical timing | Governing requirement |
|---|---|---|
| Incident detection and containment | Hours to days | Internal security program, not the rule itself |
| Initial triage: unsecured PHI involved? | Within days | 45 CFR § 164.402 definitions |
| Four-factor risk assessment drafted | Days to a few weeks | 45 CFR § 164.402(2) |
| Low-probability determination or breach call | Before day 60 from discovery | 45 CFR § 164.404(b) |
| Individual notification | No later than 60 days after discovery | 45 CFR § 164.404(b) |
| HHS notification | No later than 60 days; 500+ breaches concurrent with individuals | 45 CFR § 164.408 |
| Media notice for 500+ in a state | No later than 60 days | 45 CFR § 164.406 |
| Documentation retained | 6 years from last effective date | 45 CFR § 164.530(j) |
The assessment should be contemporaneous. Reconstructing a low-probability rationale months later invites scrutiny, and HHS has challenged after-the-fact justifications. Document reasoning at the time, including who reviewed it and what facts were known.
Edge cases and the counterintuitive detail
The most counterintuitive point: unauthorized access by a workforce member does not automatically equal a breach. If an employee opens a record by mistake and immediately closes it without reading or retaining content, the entity may document that the PHI was not actually acquired or viewed, supporting a low-probability conclusion under factor three. Conversely, a coworker who snoops in a celebrity's chart for seconds has viewed the PHI, and factor three fails even though the access was brief.
Other edge cases:
Lost unencrypted device with no evidence of access. Factor three is unresolved, and HHS generally treats this as a breach absent forensic proof of non-access. Ransomware without exfiltration. If attackers encrypted but did not remove data, many entities still treat it as a breach because access was obtained; the assessment should address whether data was viewed or taken. Misdirected email to a known, trustworthy recipient who confirms deletion. Factor four mitigation can support low probability, especially with a written attestation. Disclosure to another covered entity for treatment. This is generally permitted under the Privacy Rule, so it is not an impermissible disclosure and the breach analysis is not triggered. PHI in a cloud misconfiguration fixed within minutes. The assessment hinges on access logs, not the duration of exposure.
Red-flag warnings:
Never declare low probability before confirming whether the data was encrypted with a validated method. Never let the 60-day clock run from investigation close rather than discovery. Never rely on an oral assurance of deletion; get it in writing. Never apply a single template assessment to every incident without incident-specific facts. Never treat the risk assessment as a legal formality; HHS has demanded the underlying analysis in enforcement.
Comparison: risk assessment paths and their consequences
| Path | Standard applied | Notification duty | Documentation burden |
|---|---|---|---|
| Encrypted or destroyed PHI | Not "unsecured" under HHS guidance | None under the rule | Prove encryption method and key control |
| Four-factor assessment, low probability | 45 CFR § 164.402(2) | None if documented | Full written rationale retained 6 years |
| Four-factor assessment, breach | Presumption not rebutted | Individual, HHS, possibly media | Breach log and notification records |
| Impermissible disclosure, treatment context | Privacy Rule permission analysis first | Usually none | Privacy Rule compliance file |
| Ransomware, no exfiltration proven | Access analysis under factor three | Often treated as breach | Forensic report and assessment |
| Business associate incident | 45 CFR § 164.410 notice to covered entity | Covered entity notifies | BA agreement and notice records |
The table's central lesson: the encryption path and the low-probability path both avoid notification, but the documentation burdens differ sharply. Encryption is provable by configuration; low probability is provable only by reasoning.
Misconceptions that distort breach decisions
A common misconception holds that a small number of records means no breach. The rule contains no volume threshold. One record of unsecured PHI impermissibly disclosed is subject to the same analysis as 10,000 records, and the 500-record line governs HHS and media notice mechanics, not whether a breach occurred.
Another misconception treats the risk assessment as optional when the incident "looks minor." The rule conditions the low-probability exception on the entity demonstrating the assessment. Without documentation, the presumption stands and the incident is a breach.
A third misconception conflates security incident and breach. A security incident is any attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems. Many security incidents, such as blocked phishing attempts, involve no unsecured PHI and no breach analysis. The breach rule applies only when unsecured PHI was impermissibly acquired, accessed, used, or disclosed.
A fourth misconception assumes the business associate makes the final call. The covered entity remains responsible for its own notification obligations, and it should not simply accept a vendor's low-probability conclusion without reviewing the underlying factors.
Practical actions with concrete thresholds
Treat day zero as the date the incident is discovered or reasonably should have been discovered. Start the assessment immediately and aim to complete it well before day 45, leaving buffer for notification logistics if the conclusion is breach.
Concrete steps:
Confirm scope: identify every system and data store touched, and determine whether any held unsecured PHI. Check encryption status against HHS-specified methodologies before anything else. Preserve evidence within 24 to 48 hours: access logs, email headers, device images, and cloud audit trails. Factor three often turns on log evidence. Draft the four-factor memo with a stated conclusion, the facts known, and the facts still unknown. Note the assessment date and reviewers. Obtain written mitigation from any recipient, including deletion attestations and confirmation of no further dissemination. Set a decision deadline at day 45. If the assessment is incomplete, treat the incident as a breach and notify; the rule does not reward delay. Retain the assessment and all supporting records for 6 years under 45 CFR § 164.530(j), and log the incident in your security incident register regardless of outcome.
A useful discipline is peer review. Have a second qualified reviewer, ideally with privacy counsel, sign the low-probability determination. HHS enforcement has focused on entities that asserted low probability without a defensible record.
Limitations and what the rule cannot resolve
The four-factor test is factspecific and yields judgment calls, not mechanical answers. Two entities with identical incidents can reach different conclusions if their evidence differs, and HHS does not publish a scoring rubric. The rule also does not define every term with precision; "compromised" and "actual acquisition or viewing" require reasoned interpretation, and guidance has evolved through HHS commentary rather than rulemaking.
State breach laws add separate obligations. Many states impose their own notification triggers, timelines, and content requirements, and some are stricter than HIPAA. Compliance with the federal rule does not guarantee compliance with state law, and the assessment should be run with both frameworks in view.
Finally, this analysis addresses stable regulatory mechanics under 45 CFR Part 164. Enforcement priorities and guidance can shift, so confirm current HHS guidance for any live incident. This article is general educational information about regulatory mechanics, not a legal opinion or a substitute for advice from qualified privacy counsel; for an actual incident, consult a licensed attorney and your compliance officer promptly to preserve notification deadlines and documentation.