HIPAA breach notification: what 45 CFR 164 Subpart D requires and how HHS handles reports

Scope and what counts as a breach

This guide draws on two documents. The first is the text of 45 CFR Part 164, Subpart D, as published on the eCFR. The second is the Office for Civil Rights breach portal page at the U.S. Department of Health and Human Services (HHS).

The regulation states that its requirements apply to breaches of protected health information that occurred on or after September 23, 2009.

The regulation defines a breach as the acquisition, access, use, or disclosure of protected health information in a manner the Privacy Rule (subpart E) does not permit, where that event compromises the security or privacy of the information.

The definition lists three exclusions:

• Unintentional access by a workforce member acting in good faith and within the scope of authority.
• An inadvertent disclosure between people who are authorized to access the information at the same organization.
• A disclosure where the covered entity or business associate believes in good faith that the recipient could not reasonably have kept the information.

Outside those exclusions, the rule presumes that an impermissible use or disclosure is a breach. The presumption holds unless the covered entity or business associate shows a low probability that the information was compromised.

That showing rests on a risk assessment of at least four factors:

• The nature and extent of the information, including the types of identifiers and the likelihood of re-identification.
• The unauthorized person who used the information or received it.
• Whether the information was actually acquired or viewed.
• The extent to which the risk has been mitigated.

The duties cover only "unsecured" protected health information. The regulation defines this as information that has not been made unusable, unreadable, or indecipherable to unauthorized persons through a technology or method that the Secretary specifies in guidance.

Deadlines and notice to individuals

Every deadline in the rule runs from discovery, so the definition of discovery comes first. Under the regulation, a breach counts as discovered on the first day the covered entity knows of it, or on the first day it would have known by exercising reasonable diligence. Knowledge held by any workforce member or agent, other than the person committing the breach, counts as knowledge held by the entity.

The covered entity must notify each affected individual without unreasonable delay. Except where a law enforcement delay applies, the notice must go out no later than 60 calendar days after discovery.

To the extent possible, the regulation requires the notice to include:

• A brief description of what happened, with the date of the breach and the date of discovery if known.
• The types of information involved.
• Steps individuals should take to protect themselves.
• What the covered entity is doing to investigate, to reduce harm and to prevent further breaches.
• Contact procedures that include a toll-free telephone number, an e-mail address, a website or a postal address.

The regulation also requires the notice to be written in plain language.

Written notice goes by first-class mail to the individual's last known address. It may go by e-mail instead if the individual has agreed to electronic notice and has not withdrawn that agreement. The regulation allows the notice to be sent in more than one mailing as information becomes available.

Sometimes contact information is missing or out of date. If this affects fewer than 10 people, substitute notice may be alternative written notice, a phone call or other means. If it affects 10 or more people, the substitute notice must take one of two forms:

• A conspicuous posting on the home page of the covered entity's website for 90 days.
• A conspicuous notice in major print or broadcast media in the areas where those individuals likely live.

In both cases the notice must include a toll-free number that stays active for at least 90 days.

Notice to the media and to HHS

The media and HHS duties use slightly different thresholds, so they are worth reading side by side.

The regulation requires a covered entity to notify prominent media outlets serving a State or jurisdiction when a breach involves more than 500 residents of that State or jurisdiction. The media notice has the same 60-calendar-day outer limit as the individual notice and must carry the same content.

For breaches involving 500 or more individuals, the covered entity must notify the Secretary of HHS at the same time as it notifies individuals. That notice must follow the manner specified on the HHS website.

For breaches involving fewer than 500 individuals, the covered entity keeps a log of such breaches. It then reports the breaches discovered during the preceding calendar year no later than 60 days after the end of each calendar year.

What business associates owe

Vendors that handle protected health information for a covered entity have their own duties, and those duties run to the covered entity.

The regulation requires a business associate to notify the covered entity after discovering a breach. The deadline is the same as for covered entities: without unreasonable delay and no later than 60 calendar days after discovery. Discovery is measured from the first day the breach is known, or would have been known through reasonable diligence, to any employee, officer or other agent other than the person committing it.

To the extent possible, the business associate's notice must identify each individual whose information was involved, or is reasonably believed to have been involved. The business associate must also give the covered entity any other information it needs for its notices to individuals. That information is due at the time of notification, or promptly afterward as it becomes available.

Law enforcement delay and burden of proof

Two further provisions affect timing and documentation.

A law enforcement official may tell a covered entity or business associate that a notice would impede a criminal investigation or damage national security. If the statement is in writing and specifies a time period, notice is delayed for that period. If the statement is oral, the entity must document it, including the official's identity. The delay can then last no more than 30 days from the oral statement, unless a written statement arrives within that time.

When a use or disclosure violates the Privacy Rule, the regulation places the burden of proof on the covered entity or business associate. It must show either that all required notices were made or that the event was not a breach.

What happens to a filed report

Neither source document reproduces an individual organization's breach notice. The HHS portal page instead describes how filed reports are handled.

According to the portal, OCR investigates all breaches of protected health information and Part 2 records that affect 500 or more individuals. Smaller breaches may be investigated depending on HHS resources and enforcement priorities. The portal is also where covered entities file HIPAA breach reports and where HIPAA breach reports can be viewed.

The portal says OCR has four options for a report:

• Resolve it with technical assistance.
• Refer it to another agency.
• Investigate the breach.
• Close it without further investigation.

After an investigation, OCR sends the entity a closing letter. The portal states that in some cases OCR may negotiate a written agreement and corrective action steps to resolve compliance issues found during the investigation.