What constitutes a reportable breach, the 60-day notification clock, civil and criminal penalty tiers, and high-profile cases that reshaped compliance programs.
45 CFR §§ 164.400–164.414 | 45 CFR Part 160 Subpart D
"An impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information."
PHI that has not been rendered unusable, unreadable, or indecipherable through NIST-approved encryption or secure destruction. Breaches of unsecured PHI trigger notification obligations.
An impermissible use or disclosure is presumed to be a breach unless the covered entity or BA demonstrates that there is a low probability PHI has been compromised — using the 4-factor risk assessment.
45 CFR § 164.402 | 45 CFR § 164.400 (applicability)
A workforce member inadvertently accesses PHI in good faith and within the scope of authority, and does not further use or disclose the PHI impermissibly.
Example: Nurse accidentally opens wrong patient chart and immediately closes it.
An authorized workforce member inadvertently discloses PHI to another authorized person at the same organization, and the PHI is not further used or disclosed impermissibly.
The covered entity has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it — such as a misdirected fax that is immediately returned/destroyed.
45 CFR § 164.402(1)(i)–(iii)
To rebut the presumption of breach, analyze all four factors:
What types of PHI were involved (clinical, financial, sensitive)? Could the information cause financial, reputational, or physical harm? Was a Social Security number or financial account involved?
Was the recipient another covered entity or BA? A member of the public? A criminal actor? Would they be obligated to protect the PHI or likely to misuse it?
Was the PHI actually viewed, or was there only opportunity for access? Was a laptop merely lost, or was data confirmed to have been exfiltrated?
Has the covered entity taken steps to mitigate harm? Was the information returned or destroyed? Were systems secured after discovery? Are individuals at risk of harm?
45 CFR § 164.402(2) | 78 Fed. Reg. 5641 (HHS preamble guidance)
calendar days from discovery of the breach to complete all notifications
A breach is "discovered" on the first day a covered entity or BA knows, or by exercising reasonable diligence should have known, of the breach.
BA must notify CE without unreasonable delay and within 60 days — CE's clock then runs.
Failure to notify within 60 days is itself a HIPAA violation, separate from the underlying breach. Each day of delay can be treated as a separate violation.
45 CFR § 164.404(b) (discovery) | 45 CFR § 164.410(b) (BA notification to CE)
Written notice to each affected individual. By first-class mail (or email if authorized). Substitute notice (website/media) if contact info is out of date for 10+ individuals.
Must include: nature of breach, types of PHI involved, mitigation steps, what CE is doing, contact info.
Required when a breach affects 500+ residents of a state or jurisdiction. Notice to prominent media outlets in that state. Must occur within 60 days of discovery.
Same content requirements as individual notification.
45 CFR §§ 164.404–164.408
HHS OCR is required by statute to post breaches affecting 500+ individuals on its public website. The listing includes the covered entity name, state, number of individuals affected, type of breach, and location of breached information.
Available at: hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting
HITECH Act § 13402(e)(4) | hhs.gov/hipaa breach portal
Per violation, per year in which violation occurred (as adjusted by inflation)
CE did not know and, by reasonable diligence, would not have known of the violation
Reasonable cause to know but not willful neglect — the CE reasonably should have known
Willful neglect but violation corrected within 30 days of discovery
Willful neglect not corrected within 30 days — OCR required to impose penalty
45 CFR § 160.404 | HITECH Act § 13410(d) | HHS Penalty Calculation (2023 inflation adjustment)
42 U.S.C. § 1320d-6 — Wrongful Disclosure of Individually Identifiable Health Information
Up to $50,000 fine + 1 year imprisonment
Up to $100,000 fine + 5 years imprisonment
Up to $250,000 fine + 10 years imprisonment
Criminal cases are referred to the Department of Justice. Prosecutions of individuals (employees, nurses, billing staff) are increasing.
42 U.S.C. § 1320d-6
Largest HIPAA settlement at the time. Cyberattack exposed 78.8 million records. Failures: lack of risk analysis, no access controls, undetected malicious activity for months.
Cyberattack exposed 10.4 million records. OCR found failure to implement basic security safeguards and long-standing unaddressed vulnerabilities in IT systems.
Three separate breaches — unencrypted laptops stolen from offices and a car. 4 million records exposed. First multi-state HIPAA settlement requiring state AG cooperation.
HHS OCR Resolution Agreements — hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements