Is This a Reportable HIPAA Breach?
A guided walkthrough of the determination process under the HIPAA Breach Notification Rule, 45 CFR 164.402. Answer each question about the incident. This tool does not save or transmit any information you enter.
Step 1: Unsecured PHI Threshold
45 CFR 164.402, definition of “unsecured protected health information”
Was the protected health information involved in this incident rendered unusable, unreadable, or indecipherable to unauthorized persons through encryption or destruction that meets HHS guidance?
This means PHI encrypted to NIST standards, or destroyed so it cannot be reconstructed. Redaction, password protection alone, or partial masking do not qualify.
Step 2: The Three Exclusions
45 CFR 164.402(1)(i) through (iii)
Exclusion 1. Was the acquisition, access, or use unintentional, made in good faith by a workforce member or person acting under the authority of the covered entity or business associate, within the scope of their authority, and not resulting in further use or disclosure in violation of the Privacy Rule?
Exclusion 2. Was the disclosure inadvertent, made between two people who are both authorized to access PHI at the same covered entity, business associate, or organized health care arrangement, and not resulting in further use or disclosure in violation of the Privacy Rule?
Exclusion 3. Does the covered entity or business associate have a good faith belief that the unauthorized person to whom the disclosure was made would not reasonably have been able to retain the information?
Step 3: Four-Factor Risk Assessment
45 CFR 164.402(2). An incident that does not qualify for an exclusion is presumed to be a breach unless a risk assessment of all four factors demonstrates a low probability that PHI was compromised.
Factor 1: Nature and extent of the PHI involved. Considering the types of identifiers and the likelihood of re-identification, does this factor support a low probability of compromise?
Financial account numbers, Social Security numbers, and clinical detail increase risk. Limited demographic data with no clinical detail lowers it.
Factor 2: Unauthorized person who received or used the PHI. Does this factor support a low probability of compromise?
Disclosure to another HIPAA-covered entity or a person with an independent obligation to protect the information lowers risk. Disclosure to an unknown third party raises it.
Factor 3: Whether the PHI was actually acquired or viewed. Does this factor support a low probability of compromise?
Forensic evidence that a lost device was never accessed, or that a misdirected fax or email was returned unopened, lowers risk. Confirmed viewing or download raises it.
Factor 4: Extent to which the risk has been mitigated. Does this factor support a low probability of compromise?
Obtaining a signed confidentiality statement, confirming remote wipe of a device, or securing a written destruction assurance lowers risk.
Step 4: Determination
This tool provides general guidance based on the HIPAA Breach Notification Rule and does not constitute legal advice. Every incident should be documented in writing with the rationale for its determination. Consult qualified legal counsel for a final determination, particularly for incidents involving state breach notification laws or ambiguous facts.