The HIPAA Breach Notification Rule, explained

A HIPAA breach is an impermissible acquisition, access, use or disclosure of protected health information (PHI) that compromises its security or privacy. The breach is presumed unless a risk assessment shows a low probability of compromise (45 CFR 164.402).

What counts as a HIPAA breach?

A HIPAA breach is an acquisition, access, use or disclosure of PHI in a manner the Privacy Rule does not permit (45 CFR 164.402). HHS describes a breach as generally an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI (HHS breach notification guidance).

The breach definition presumes that every impermissible use or disclosure is a breach. The practice starts from that presumption and then applies the four factors described below.

Notice duties apply only to unsecured PHI, meaning PHI not rendered unusable, unreadable or indecipherable to unauthorized persons (164.402). Covered entities and business associates carry the burden of showing that all required notices were given, or that a use or disclosure was not a breach.

What is the four-factor risk assessment?

The four-factor risk assessment is the test the breach definition applies before a practice can rebut the presumption of breach. The test applies to every impermissible use or disclosure, including a misdirected fax or email. The table lists the four factors, each with its citation in 45 CFR 164.402, and what the practice weighs under each.

The four factors are read together. To rebut the presumption of breach, the practice must show a low probability of compromise after weighing all four. Each factor is a question the practice answers from its own records: what the page contained, who received it, whether anyone opened it, and what the practice did afterward to limit exposure.

Is a fax sent to the wrong number a breach?

A fax sent to the wrong number can be a breach, because it is an impermissible disclosure unless the four-factor assessment shows a low probability of compromise (45 CFR 164.402). A fax read by the wrong recipient is usually unsecured PHI, because the recipient can read it.

The good-faith exception is a separate ground in the breach definition (164.402, paragraph (1)(iii)). It applies when the practice has a good-faith belief that the unauthorized recipient would not reasonably have been able to retain the information. The four factors still describe how the practice assesses the disclosure. The first facts to establish are what the recipient received and whether anyone viewed it, because those answer the second and third factors.

For the fax-specific answer, read HIPAA for a fax sent to the wrong number.

How long do you have to report a HIPAA breach?

A covered entity must notify each affected individual without unreasonable delay, and in no case later than 60 calendar days after discovery of the breach (45 CFR 164.404(b)). A breach counts as discovered on the first day it is known to the covered entity, or would have been known with reasonable diligence (164.404(a)(2)).

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410). That business associate deadline sits alongside the covered entity's own 60-day deadline under 164.404(b).

Who must a practice notify after a breach?

The practice, as a covered entity, must notify each individual whose unsecured PHI was involved (45 CFR 164.404(a)(1)), so a misdirected fax that holds several patients' records requires one notice per patient. If more than 500 residents of a state or jurisdiction are involved, the practice must also notify prominent media outlets in that state (164.406(a)). A breach involving exactly 500 residents falls short of that threshold. The notice to each individual is the core duty, and the media and HHS notices depend on how many people or residents the breach involves.

Do you report a breach under 500 people to HHS?

A breach involving fewer than 500 individuals goes to HHS in an annual submission. The covered entity keeps a log and notifies the Secretary no later than 60 days after the end of each calendar year, for the breaches discovered during that year (45 CFR 164.408(c)). A breach involving 500 or more individuals requires notice to the HHS Secretary at the same time as the individual notices (164.408(b)).

What makes PHI secured under the breach notification rule?

PHI is secured when it is rendered unusable, unreadable or indecipherable to unauthorized persons by a method HHS specifies (45 CFR 164.402). Only unsecured PHI triggers the notice duties in 164.404 through 164.410. HHS guidance names encryption and destruction as the technologies and methodologies for this purpose.

Does a business associate have to report a breach?

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410). The duty applies to a business associate, which is an outside party that handles PHI on the covered entity's behalf (45 CFR 160.103).

The contract with that business associate must require it to report any use or disclosure the contract does not provide for, including breaches of unsecured PHI under 164.410 (164.504(e)(2)(ii)(C)). The HIPAA fax requirements checklist lists the fax-specific duties a practice carries into these contracts.

* The regulation text was read at law.cornell.edu and HHS guidance at hhs.gov on October 13, 2026.