Unauthorized acquisition, access, use, or disclosure of protected health information can constitute a breach under the HIPAA Privacy Rule. Proof that someone viewed the information is unnecessary, and the incident may qualify even if nobody published it or caused measurable harm.
This guide explains the legal definition, risk factors, exclusions, notification duties, and documentation steps for healthcare organizations, covered entities, Business Associates, and privacy teams handling suspected incidents.
Unauthorized Interaction With Protected Health Information
The legal standard extends beyond a technical malfunction. An event may involve Protected Health Information (PHI) and an interaction that falls outside the person’s legal authority to acquire, access, use, or disclose it.
PHI includes individually identifiable health information held or transmitted by a covered entity or Business Associate. A failed login alone does not establish a breach, but unauthorized access to a patient chart can meet the definition even if the person performs no further action.
You need to examine three connected questions: what information was involved, what the person was permitted to do, and whether the interaction was impermissible. Incident labels such as “email error” or “security event” do not answer those questions by themselves.
| Event | Breach analysis |
|---|---|
| An employee opens a patient chart outside assigned duties | Unauthorized access may qualify even if the employee takes no further action. |
| A patient summary goes to the wrong recipient | An impermissible disclosure may qualify despite an accidental mistake. |
| An intruder reaches a hospital network but retrieves no data | The event creates security concerns but may not be a reportable breach. |
| A covered entity performs all permitted handling | No breach occurred unless a separate law or policy was violated. |
Unauthorized Access Can Satisfy the Definition
Access without permission can establish a breach through the act of reaching the record itself. Investigators do not have to prove that the person read, copied, or misused the information, whether it appeared on paper, in electronic protected health information, or in a clinical portal.
Federal regulations presume that an impermissible acquisition, access, use, or disclosure is a breach. A covered entity may rebut that presumption through a documented, good-faith Risk Assessment showing a Low Probability of Compromise under 45 C.F.R. § 164.402.
Compromise is a grammatically complete term here because it follows the linking phrase “a.” The legal question centers on whether the privacy or security of PHI was affected in a way that creates a meaningful risk of harm.
Low Probability of Compromise in Practice
The same unauthorized interaction can produce different results because its surrounding facts differ. A trusted employee’s brief receipt of a misdirected summary presents different evidence from the theft of a device holding years of sensitive patient records.
A defensible Risk Assessment considers these connected factors:
- Information sensitivity: Document the clinical and financial consequences that could follow from exposure.
- Recipient reliability: Identify what the recipient knew about the incident when receiving the information.
- Probable acquisition: Establish whether PHI actually came into the recipient’s possession.
- Mitigation efforts: Record how quickly the organization contained the incident and recovered or protected the information.
- Risk of harm: Evaluate whether the information could be used, exposed, altered, or otherwise cause harm.
Documenting the Risk Assessment
A usable record explains what happened, who investigated it, which systems or records were involved, and why the evidence supports the conclusion. A statement that no harm occurred cannot replace a fact-based analysis of the potential harm.
You should separate confirmed events from assumptions. Document whether the recipient opened an email, whether someone copied the data, how the organization verified each point, and whether an employee could access the records after containment.
That documentation also supports consistency across the breach determination, the Security Rule analysis, and later notice decisions. Preserve system logs, messages, access reports, witness notes, and evidence of remediation under a defined incident file.
Applying the Theft and Diversion Rule
Impermissible acquisition or use of PHI or ePHI through theft or diversion receives special treatment. The ordinary rebuttable presumption and Low Probability of Compromise analysis do not apply in the same way to these incidents.
You should record why the facts fit this rule and preserve evidence of the loss, possession, or diversion. Broader circumstances may still influence mitigation, patient notice, and corrective action, even when the special rule establishes the breach.
Keep the theft rule separate from the general Risk Assessment. Document the basis for the special classification and retain its supporting evidence.
Incidents That May Meet the Breach Definition
A lost clinic laptop shows why the device’s settings and contents determine the outcome. A functioning, properly verified encryption system may lead to a different result from an unlocked device containing accessible patient records.
Investigators should establish the device’s security status, access settings, contents, and time outside organizational control. They also need evidence about whether anyone acquired, accessed, copied, altered, used, or disclosed the information.
Several common scenarios involve an interaction that may be impermissible:
- Hacking: Intruders obtain patient records or use stolen credentials to reach clinical systems.
- Lost devices: A phone, laptop, or drive contains accessible PHI and leaves organizational control.
- Employee mistakes: A worker opens, copies, or sends records outside assigned responsibilities.
- Misdirected communications: A fax, email, or portal message reaches the wrong person.
- Paper exposure: Records are lost, copied, or viewed outside proper handling.
- Portal misuse: Someone uses another patient’s account without an authorized relationship.
Accidental intent does not automatically remove an incident from the definition. A trusted recipient who receives the wrong patient summary may still cause an impermissible disclosure, even when immediate deletion lowers the probability of harm.
That impermissible disclosure can occur across ordinary handling channels, making the medium a practical fact in the breach analysis.
Paper, Email, Devices, and Portals
The same legal analysis applies across different formats because the Privacy Rule protects information rather than a particular storage method. A paper record exposed at a clinic can present the same acquisition or disclosure issue as an email sent to a wrong recipient.
When a paper file goes missing, investigators should determine who controlled it, who could see its contents, and whether anyone copied or disclosed it. An incident report identifying a missing chart establishes loss, but it does not automatically establish that a person acquired the PHI.
Email and faxes require separate attention to recipients, attachments, delivery confirmation, access, and deletion. For a patient portal, review account ownership, authentication records, permitted relationships, audit logs, and the exact records viewed.
Mobile devices require facts about lock settings, encryption, storage, remote access, and possession. A lost device may hold PHI, access credentials, or both, and those risks can change even if no person has yet opened the record.
| Format | Evidence to preserve |
|---|---|
| Paper records | Custody history, access rights, copies, photographs, and disposal records |
| Email or fax | Recipient, delivery status, attachments, message history, and deletion confirmation |
| Mobile device | Lock settings, encryption, stored records, credentials, and remote-access logs |
| Patient portal | Account ownership, role, authentication events, audit trail, and viewed records |
Accidents and Deliberate Misconduct
A mistaken disclosure and a deliberate public posting both require analysis, but intent alone does not determine the result. The recipient’s relationship with the information, the method of disclosure, the information’s sensitivity, and its subsequent use all affect compromise.
Suppose a nurse emails a discharge list to a physician at another hospital, and the physician confirms immediate deletion without opening it. That scenario differs from a hacker copying the same list and posting it on an online forum.
The first incident may support a Low Probability of Compromise after investigation. The second presents stronger evidence of acquisition, use, public disclosure, and potential harm, but the final decision must still rest on documented evidence.
Activities Excluded From the Breach Definition
The formal definition contains exclusions for certain impermissible uses or disclosures. These are narrow exceptions, and you must identify the precise provision and preserve evidence that every condition was satisfied.
Depending on the circumstances, an exclusion may cover an activity permitted by law under 45 C.F.R. § 164.400-414, certain public-health reporting activities, or a limited data set disclosure conducted under specified conditions. The Privacy Rule’s complete requirements control.
A security failure can also occur without a reportable privacy breach. A weak password, defective access control, or inadequate risk-management process may violate the HIPAA Security Rule even when nobody acquires, uses, or discloses PHI.
That distinction matters because Breach Notification obligations address qualifying breaches involving unsecured PHI. Corrective security work may still be necessary, but a risk-management failure does not automatically trigger individual, Media Notification, or regulatory reporting.
Encrypted and Otherwise Protected Information
Verified protection can place ePHI outside the breach notification requirements. An encrypted record may remain unreadable after it leaves organizational control because possession of the ciphertext does not provide access to the decryption key.
The protection must have operated properly, and the organization must have a reasonable basis to believe that anyone obtaining the data could not decode it. A general statement that a system was designed to use encryption does not establish that those requirements were met.
Electronic protected health information is unsecured unless the covered entity or Business Associate rendered it unusable or unreadable through encryption or another effective protection method. The organization’s burden is to verify that result rather than assume it.
Verifying Encryption and Key Security
Properly encrypted ePHI falls outside the HIPAA breach notification requirements when the relevant keys were not compromised and were not reasonably expected to be compromised. Another protection method may produce the same result if it meets the rule’s effectiveness standard.
A key stored beside an encrypted file does not automatically protect the information. Investigate the encryption method, key location, access permissions, system settings, credential controls, and evidence that an unauthorized person could not reasonably obtain a key.
Document the exact date and time of verification when possible. Preserve the configuration, audit results, key-management record, and identity of the person who confirmed the control.
Correcting Underlying Security Failures
An exception from Breach Notification does not excuse a Security Rule failure. The organization may still need to correct access controls, revise its risk analysis, update policies, or address safeguards that failed during the incident.
Separating the two legal conclusions prevents both overreporting and underreaction. One record can document why the event was or was not a breach of unsecured PHI, while another tracks the security deficiencies and corrective actions that remain necessary.
Once the breach determination is documented, the next challenge is satisfying every applicable notification duty on the required timeline.
Encryption supports the legal conclusion only when proof shows that the protection worked. An intended control is not the same as a verified safeguard.
Breach Notification Duties and Deadlines
Once a breach involves unsecured PHI, the response path depends on the affected population and the federal deadlines. The HIPAA Breach Notification Rule, enacted through the HITECH Act, imposes duties on covered entities and Business Associates.
You must coordinate the analysis even when several records contain the same patient information. Include affected individuals in the count, document the jurisdictions involved, and identify which notices are required by federal law rather than state law.
| Recipient | Applicable duty |
|---|---|
| Affected individuals | Receive notice without unreasonable delay and no later than 60 calendar days after discovery. |
| HHS for 500 or more individuals | Submit a contemporaneous breach report through the required process. |
| HHS for fewer than 500 individuals | Submit the required report within 60 calendar days after the end of the calendar year. |
| Media | Receive notice when a breach affects 500 or more individuals in a state or jurisdiction. |
| Business Associate | Report the incident to the covered entity without unreasonable delay and no later than 60 calendar days after discovery. |
Coordinating the Organizational Response
The covered entity coordinates required notices and retains responsibility for oversight. A Business Associate must support the investigation, limit further disclosure, and report the event under its contract and the Breach Notification Rule.
Each party should preserve the facts, system records, messages, contracts, and evidence supporting the determination. Define who has authority to make the final breach decision and record each participant’s role.
Media Notification does not follow automatically from hacking, identity theft, or a large database. It applies when a breach affects at least 500 individuals within the relevant state or jurisdiction, while notices to affected individuals and HHS may still apply to smaller breaches.
Contents, Timing, and Law Enforcement
Notice to an affected individual must describe what happened, identify the types of unsecured information involved, explain the likely effect, and provide protective steps. A generic message copied from an earlier case may not give the person enough accurate information.
Law enforcement may delay notice in limited circumstances under the rule. Document the official requesting the delay, the scope and basis of the request, the responsible decision-makers, and the supporting evidence.
A delay changes the timing analysis; it does not eliminate the need to determine whether a breach occurred. Preserve the final notification decision and the reasons for any delay alongside the original incident evidence.
These HIPAA breach notification rules are supported by breach guidance and reporting portals maintained by the U.S. Department of Health and Human Services Office for Civil Rights. That authority supports accurate federal reporting while state and local requirements may create additional obligations.
Applying those deadlines is often where misclassifications, missed notice, and incomplete reports reveal their practical consequences.
Common Errors in Breach Decisions
A failed login can require a Security Rule investigation without meeting the Privacy Rule’s breach threshold. A wrong-recipient email can qualify despite lacking malicious intent, which is why the required analysis cannot be skipped.
These errors appear repeatedly in incident reviews:
- Automatic reporting: Treating every security event as a breach removes the required Privacy Rule analysis.
- Unsupported low risk: Concluding that compromise was improbable without evidence or a documented reason.
- Missed access: Focusing on disclosure while overlooking acquisition or access without permission.
- Weak encryption claim: Treating a system as protected without verifying keys, settings, and access paths.
- Poor recordkeeping: Losing logs, witness notes, or mitigation records needed to support the result.
- Confused legal duties: Mixing Breach Notification with the Security Rule’s separate risk-management duties.
These mistakes can prevent you from determining when a HIPAA violation becomes a breach. The answer depends on the prohibited interaction, compromise risk, applicable exclusions, and verified protections,not on the incident label alone.
Applying a Documented Decision Process
A structured record keeps each suspected incident consistent with the legal requirements. It separates facts from assumptions and shows why the final determination follows from the available evidence.
- Identify the information: Determine whether the records are PHI or ePHI and describe the data involved.
- Classify the interaction: Record any acquisition, access, use, or disclosure and the basis for permitted handling.
- Assess compromise: Evaluate sensitivity, recipient, acquisition probability, mitigation, and risk of harm.
- Check exclusions: Review statutory exceptions, theft or diversion, and verified effective protections.
- Preserve evidence: Retain logs, communications, reports, and the reasoning behind each decision.
- Apply notice duties: Map the confirmed breach and affected population to the required notifications.
A security incident can remain outside the formal breach definition while revealing a serious weakness in reasonable safeguards. The defensible outcome rests on a recorded analysis, not on the incident’s label or the hope that no harm will appear.
Bottom Line
Treat an impermissible acquisition, access, use, or disclosure of PHI as the starting point for analysis, not as a proven reportable incident in every case. Confirm the facts, assess compromise, review each exclusion, and verify effective protections before applying notification deadlines.
A complete record protects patients and gives covered entities, Business Associates, and privacy teams a defensible basis for every notice decision. It also separates a formal breach from a security problem that still requires correction.
FAQ
What legally counts as a HIPAA breach?
A legally reportable breach generally involves an impermissible acquisition, access, use, or disclosure of Protected Health Information that violates the Privacy Rule. The incident can qualify without public exposure, actual misuse, or proof that someone viewed the PHI, subject to the applicable risk assessment, exclusions, and protections.
What types of incidents does HIPAA consider a breach, and which situations may not qualify?
Hacking, lost devices, employee mistakes, misdirected faxes, unauthorized portal use, paper exposure, and improper email disclosure may qualify. An event may not qualify when it lacks an impermissible PHI interaction, a specific Privacy Rule exclusion applies, an incident falls within the theft rule, or properly verified protection prevents the information from being considered unsecured.
What does the low probability of compromise standard mean in practice?
The standard asks whether a good-faith assessment shows that the privacy or security of PHI was probably not affected in a way creating a meaningful risk of harm. You should document the information’s sensitivity, the recipient, the probability of acquisition, mitigation, and the possibility of harm.
Do accidental disclosures, lost devices, hacking, and employee mistakes qualify as HIPAA breaches?
They can qualify when they involve an impermissible acquisition, access, use, or disclosure. Accidental intent does not create a blanket exception, while a lost device, hack, or employee error may fall outside the notification requirements if verified safeguards rendered the information unreadable or another applicable rule applies.
How does the breach definition apply to paper records, email, faxes, mobile devices, and patient portals?
The definition applies across those formats whenever the records contain PHI. Investigators must examine custody, access authority, recipient, acquisition, use, disclosure, encryption, and mitigation, using evidence such as paper logs, delivery records, device settings, and portal audit trails.
What is the difference between a breach of unsecured PHI and a security incident involving encrypted PHI?
Notices may follow exposure of unsecured PHI, while properly encrypted ePHI generally falls outside breach requirements when its keys remain secure and were not reasonably expected to be compromised. A security failure may still require correction even when no reportable breach occurred.
