Written and maintained by CASRAI Editorial Board
Last updated
The HIPAA Breach Notification Rule, codified at 45 CFR Part 164, Subpart D (§§ 164.400–164.414), requires HIPAA-covered entities and their business associates to provide notification following a breach of unsecured Protected Health Information (PHI). Promulgated pursuant to Section 13402 of the HITECH Act and modified by the 2013 HIPAA Omnibus Final Rule, Subpart D establishes the legal definition of a breach, the four-factor risk assessment standard, the encryption and destruction safe harbor, and strict 60-day reporting deadlines to affected individuals, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), and the media.
What Is the HIPAA Breach Notification Rule and How Is It Used in Clinical Research and Healthcare?
Under 45 CFR § 164.402, a breach is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted under Subpart E (the HIPAA Privacy Rule) which compromises the security or privacy of the PHI. Since the 2013 HIPAA Omnibus Final Rule replaced the earlier “significant risk of financial, reputational, or other harm” threshold, any impermissible use or disclosure of PHI is presumed to be a reportable breach unless the covered entity or business associate demonstrates—through a documented written risk assessment—that there is a low probability that the PHI has been compromised.
In academic medical centers, clinical trial sites, and health informatics environments, the Breach Notification Rule governs what happens when research databases, unencrypted laptops, electronic data capture (EDC) exports, or clinical records experience unauthorized disclosure—such as emailing an unmasked participant screening log outside the covered entity or suffering a ransomware exfiltration event at a vendor operating under a Business Associate Agreement (BAA).
The Mandatory Four-Factor Risk Assessment (45 CFR § 164.402(2))
To overcome the presumption of a breach, privacy and security officers must evaluate at least four statutory factors objectively:
- The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification: Does the exposed dataset contain direct identifiers (names, Social Security numbers, medical record numbers), sensitive clinical diagnoses (such as mental health, substance use, or HIV status), or financial account numbers, or is it a partially masked dataset with low re-identification likelihood? (Note: de-identified data under 45 CFR § 164.514(b) is not PHI and is not subject to the Rule.)
- The unauthorized person who used the PHI or to whom the disclosure was made: Was the recipient another HIPAA-covered entity or bound by federal confidentiality obligations, or an external untrusted actor?
- Whether the PHI was actually acquired or viewed: Do forensic server logs or HIPAA Security Rule audit trails show that the unauthorized party opened, queried, or exfiltrated the files, or only that an opportunity for access existed without actual viewing?
- The extent to which the risk to the PHI has been mitigated: Did the organization obtain a verifiable written attestation of destruction or non-retention from an inadvertent recipient immediately upon discovery?
Three Statutory Exceptions to a “Breach” (§ 164.402(1)(i)–(iii))
The regulation excludes three specific operational scenarios from the definition of a breach:
- Unintentional Workforce Access (§ 164.402(1)(i)): Unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a covered entity or business associate, if made in good faith and within the scope of authority, and if it does not result in further impermissible use or disclosure.
- Inadvertent Internal Disclosure (§ 164.402(1)(ii)): Inadvertent disclosure by a person authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the same covered entity, business associate, or organized health care arrangement (OHCA), provided the information is not further used or disclosed impermissibly.
- Inability to Retain (§ 164.402(1)(iii)): A disclosure where the covered entity or business associate has a good-faith belief that the unauthorized person to whom the disclosure was made would not reasonably have been able to retain the information.
What Standards or Regulatory Requirements Govern the HIPAA Breach Notification Rule?
1. Unsecured PHI and the NIST Encryption / Destruction Safe Harbor
Subpart D notification obligations apply only to unsecured PHI. Under 45 CFR § 164.402 and HHS Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, PHI is considered secured (and therefore exempt from breach notification even if lost or stolen) when protected by one of two technical methods:
- Encryption: Algorithmic transformation of electronic PHI (ePHI) using cryptographic processes tested by NIST—specifically NIST SP 800-111 for data at rest (storage media, databases, laptops, mobile devices) and NIST SP 800-52 (TLS), SP 800-77 (IPsec VPN), or SP 800-113 for data in motion—provided the confidential decryption key or process has not also been breached.
- Destruction: Paper, film, or hard copy media shredded or destroyed such that PHI cannot be read or reconstructed, and electronic media cleared, purged, or destroyed in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization).
2. Notification Tiers, Thresholds, and Statutory Timelines (§§ 164.404–164.412)
When a breach of unsecured PHI occurs, notifications must be issued according to the statutory schedule summarized below. Under § 164.404(a)(2), a breach is treated as “discovered” on the first day the breach is known—or by exercising reasonable diligence would have been known—to any workforce member or agent (other than the person committing the breach).
| CFR Section | Notification Recipient | Trigger / Record Threshold | Maximum Statutory Deadline | Delivery & Content Requirements |
|---|---|---|---|---|
| § 164.404 | Affected Individuals | Any breach of unsecured PHI (1 or more individuals) | Without unreasonable delay and no later than 60 calendar days from discovery | Written notice by first-class mail (or email if agreed). Must describe the incident, types of PHI involved, steps individuals should take, mitigation actions, and contact procedures. Substitute notice (web posting or major print/broadcast media + toll-free number for 90 days) required if 10+ individuals have out-of-date contact info. |
| § 164.406 | Prominent Media Outlets | More than 500 residents of a single State or jurisdiction | Without unreasonable delay and no later than 60 calendar days from discovery | Press release or formal notification to prominent media outlets serving the affected State or jurisdiction containing the same core elements as individual notice. |
| § 164.408(b) | HHS Secretary (OCR Portal) — Large Breaches | 500 or more individuals (total across all states) | Contemporaneously / without unreasonable delay and no later than 60 calendar days from discovery | Submitted electronically via the HHS OCR Breach Portal (published on the public OCR breach archive under HITECH § 13402(e)(4)). |
| § 164.408(c) | HHS Secretary (OCR Portal) — Small Breaches | Fewer than 500 individuals | No later than 60 days after the end of the calendar year in which the breach was discovered | Logged internally throughout the calendar year and submitted electronically to HHS OCR by early March of the following year. |
| § 164.410 | Covered Entity (by Business Associate) | Any breach discovered at a Business Associate | Without unreasonable delay and no later than 60 calendar days from discovery (BAAs often contractually set 5–15 days) | Business associate must provide the identity of each affected individual and all available details required for the covered entity’s § 164.404 notice. |
Under 45 CFR § 164.412, if a law enforcement official states to a covered entity or business associate that a notification, notice, or posting would impede a criminal investigation or cause damage to national security, the entity must delay notification for the time period specified in writing by the official (or up to 30 days following an oral statement unless extended in writing). Under § 164.414(b), the covered entity or business associate bears the statutory burden of proof to demonstrate that all required notifications were made or that an impermissible use or disclosure did not constitute a breach.
How Does the HIPAA Breach Notification Rule Integrate With EHR and Health Informatics Workflows?
- Architectural Safe Harbor Enforcement: Health informatics teams configure EHR database volumes, cloud research enclaves, and researcher workstations with FIPS 140-2/140-3 validated AES encryption (NIST SP 800-111) and enforce TLS 1.2/1.3 for all HL7 FHIR and DICOM traffic so hardware theft or media loss remains outside the definition of unsecured PHI.
- Audit Trail Forensics for Factor 3 Analysis: When a misconfiguration occurs in an EHR patient portal, clinical data warehouse, or EDC integration, granular EHR access and query logs (`AuditEvent` records) allow forensic teams to prove whether specific patient records were actually viewed or downloaded, directly supporting Factor 3 of the § 164.402 risk assessment and data security incident notification requirements.
Sources
- Electronic Code of Federal Regulations (eCFR). 45 CFR Part 164, Subpart D — Notification in the Case of Breach of Unsecured Protected Health Information (§§ 164.400–164.414). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D
- U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Breach Notification Rule & Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
