How does hhs define a breach

Content on WhatAnswers is provided "as is" for informational purposes. While we strive for accuracy, we make no guarantees. Content is AI-assisted and should not be used as professional advice.

Last updated: April 8, 2026

Quick Answer: The U.S. Department of Health and Human Services (HHS) defines a breach under the HIPAA Breach Notification Rule as the acquisition, access, use, or disclosure of protected health information (PHI) in a manner not permitted by the HIPAA Privacy Rule, which compromises the security or privacy of the PHI. This definition specifically excludes certain unintentional acquisitions, accesses, or uses by workforce members acting in good faith within their scope of authority, as well as inadvertent disclosures to authorized persons at the same organization. The rule requires covered entities to conduct a risk assessment to determine if there is a low probability that the PHI has been compromised; if not, it must be treated as a breach. Breaches affecting 500 or more individuals must be reported to HHS within 60 days, while smaller breaches can be reported annually.

Key Facts

HHS defines a breach under the HIPAA Breach Notification Rule, effective September 23, 2009, as unauthorized PHI disclosure compromising security or privacy.
Exclusions include unintentional access by workforce in good faith and inadvertent disclosures to authorized persons at the same entity.
A risk assessment is required to determine breach status; if low probability of compromise is not shown, it is a breach.
Breaches affecting 500+ individuals must be reported to HHS within 60 days; smaller breaches are reported annually.
The rule applies to covered entities (e.g., healthcare providers) and business associates handling PHI, with penalties up to $1.5 million per violation.

Overview

The HHS definition of a breach is rooted in the Health Insurance Portability and Accountability Act (HIPAA) of 1996, which established national standards for protecting health information. The HIPAA Breach Notification Rule, implemented as part of the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, specifically outlines breach requirements. Effective September 23, 2009, this rule mandates that covered entities, such as healthcare providers, health plans, and healthcare clearinghouses, and their business associates, notify individuals, HHS, and sometimes the media following a breach of unsecured protected health information (PHI). PHI includes identifiable health data like names, Social Security numbers, and medical records. The rule aims to enhance transparency and accountability in healthcare data security, addressing growing concerns over data breaches in the digital age. Historically, prior to 2009, breach notification was inconsistent across states, leading to the federal standardization under HHS oversight to ensure uniform protection and response nationwide.

How It Works

HHS defines a breach through a multi-step process under the HIPAA Breach Notification Rule. First, an incident involving PHI must be evaluated to determine if it constitutes a breach: it involves acquisition, access, use, or disclosure not permitted by the HIPAA Privacy Rule, and it compromises the security or privacy of the PHI. Key mechanisms include exclusions, such as unintentional acquisition or access by a workforce member acting in good faith within their authority, or inadvertent disclosure to an authorized person at the same organization. If not excluded, a risk assessment is conducted to assess the probability that the PHI has been compromised, considering factors like the nature of the PHI, unauthorized person involved, and whether the PHI was actually viewed or acquired. If the assessment shows a low probability, it may not be a breach; otherwise, notification is required. Notifications must be sent to affected individuals without unreasonable delay, within 60 days of discovery, and to HHS—immediately for breaches of 500+ individuals, or annually for smaller ones. This process ensures timely response and mitigation of data security risks.

Why It Matters

The HHS breach definition matters significantly for protecting patient privacy and maintaining trust in the healthcare system. Real-world impact includes preventing identity theft, fraud, and emotional distress for individuals whose PHI is exposed; for example, in 2023, HHS reported over 700 large breaches affecting millions, highlighting ongoing risks. Applications extend to legal compliance, as failure to report breaches can result in hefty penalties—up to $1.5 million per violation—and reputational damage for organizations. This framework drives improvements in data security practices, such as encryption and access controls, reducing breach likelihood. Significance lies in fostering a culture of accountability, ensuring that healthcare entities prioritize data protection, which is critical as digital health records become more prevalent. Ultimately, it supports public health by safeguarding sensitive information, enabling better healthcare delivery without compromising patient confidentiality.