What is the HIPAA Breach Notification Rule? Notice duties after a health data breach, defined

The HIPAA Breach Notification Rule, at 45 CFR 164.400 to 164.414, requires covered entities under the Health Insurance Portability and Accountability Act (HIPAA), and their business associates, to give notice after a breach of unsecured protected health information. Individuals must be told without unreasonable delay and within 60 calendar days of discovery, and the Department of Health and Human Services (HHS), and sometimes the media, must be told too.

What counts as a breach

Under 45 CFR 164.402, an acquisition, access, use or disclosure of protected health information that the Privacy Rule does not permit is presumed to be a breach. The presumption falls only if a risk assessment shows a low probability of compromise, weighing the nature of the data, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated. Data rendered unusable to unauthorized persons, by encryption or destruction under HHS guidance, is not unsecured, so its loss needs no notice.

Who must be told, and when

A breach counts as discovered on the first day it is known, or would have been known with reasonable diligence. Breaches involving more than 500 residents of a state or jurisdiction also require notice to prominent media outlets there. For 500 or more individuals, HHS is notified at the same time as the individuals; smaller breaches go in a log reported within 60 days after the end of the calendar year. Business associates must tell the covered entity within 60 days of discovery, and the entity carries the burden of proving every notice was made.

Why it matters to a CISO

Ransomware shows how the presumption works. HHS says that when ransomware encrypts electronic protected health information, a breach has occurred, so the four-factor assessment, not the recovery of systems, decides whether notice can be skipped. HHS also publishes a list of breaches affecting 500 or more individuals.

What it is not

It is not the FTC's Health Breach Notification Rule, which covers vendors of personal health records and their service providers. It does not displace state breach notification laws, and it is separate from any SEC filing the same incident may require.

Where it appears on cisonews.net

Health care filings in the incident log include UnitedHealth Group's Change Healthcare disclosure and iRhythm Holdings, where patient health information was taken. The litigation over the Change Healthcare attack is described under multidistrict litigation.