Module 04 · Free · 7:56
HIPAA Breach Notification Rule Training
The definition of a breach and the three exceptions to it, what unsecured PHI is, the individual/media/HHS notification timelines, business associate notification, and the administrative documentation the rule requires.
The Breach Notification Rule governs what a practice must do when patient information is compromised. This module covers the definition of a breach, the three specific exceptions to that definition, what "unsecured PHI" actually means, the notification methods and 60-day timelines for individuals / HHS / media, business associate notification, and the administrative documentation the rule requires the practice to maintain.
Regulatory anchors
- 45 CFR §164.402
- 45 CFR §164.404
- 45 CFR §164.406
- 45 CFR §164.408
- 45 CFR §164.410
- 45 CFR §164.414
Hosted on the Patient Protect YouTube channel
HIPAA Breach Notification Rule Explained: What to Do After a Breach
The Breach Notification Rule is the part of HIPAA that governs what a practice must do after unsecured Protected Health Information is compromised — the analysis that determines whether an incident is a breach, the people who have to be notified, the deadlines that apply, and the documentation the practice has to keep whether or not notifications go out. For a workforce member, the most useful skill this module builds is recognizing that not every incident is a breach and that the analysis matters. A misdirected email, an accidental chart-open, a lost device, a phishing message that got clicked — each requires evaluation, not automatic escalation and not automatic dismissal. The steps below are the framework practices actually run when something happens.
Learning objectives
What the workforce should be able to do after this module.
- Understand the purpose of the Breach Notification Rule
- Define what constitutes a breach and identify the three exceptions
- Learn breach notification requirements, methods, and timelines
- Understand documentation and compliance responsibilities
Assessment: 5 knowledge-check questions per module, 80% passing standard.
Module outline
Section-by-section walkthrough.
01
Purpose of the Breach Notification Rule
The rule ensures that patients, regulatory authorities, and — in some cases — the public are informed when patient information has been compromised. It promotes transparency, accountability, and timely response, and reinforces the HHS requirements for privacy and security.
02
Definition of a breach
A breach is the unauthorized access, use, or disclosure of PHI or ePHI that compromises the security or privacy of that information. Not all incidents are breaches — three specific exceptions apply.
03
The three exceptions to breach
Exception 1: unintentional acquisition, access, or use of PHI by a workforce member, Business Associate, or someone acting under the authority of a Covered Entity — done in good faith, within the scope of their role. Exception 2: an inadvertent disclosure of PHI between two people who are both authorized to access it at the same covered entity, business associate or organized health care arrangement — provided the information is not further disclosed beyond what the Privacy Rule permits. Note this is disclosure within one organization, not provider to provider. Exception 3: good-faith belief that the unauthorized individual who accessed the PHI could not retain the information — the information was immediately destroyed, not understood, or could not be copied or shared.
04
Unsecured PHI — the trigger for notification
Unsecured PHI is patient information that has not been encrypted or has not been properly disposed of per HHS standards. HHS states that breach notification is only required when the breach involves unsecured PHI. Encryption and proper disposal remain the strongest protection against triggering notification obligations.
05
Individual notification — first-class mail or email, 60 days
Affected individuals must be notified without unreasonable delay and no later than 60 days after the breach is discovered. Notification should be sent by first-class mail, or by email if the patient has agreed to receive communications electronically. If contact information is outdated for 10 or more individuals, the practice must give substitute notice either by posting on its website home page for at least 90 days or by notice in major print or broadcast media where the affected individuals likely live, and must include a toll-free number that stays active for at least 90 days. The 90 days attaches to the web posting and the phone number, not to the media publication. For fewer than 10 individuals, alternative methods (phone or written notice) may be used.
06
Media notification — more than 500 residents of a State
If a breach affects more than 500 residents of a State or jurisdiction, the practice must notify prominent media outlets serving that area, without unreasonable delay and no later than 60 calendar days after discovery. Note this threshold differs from the one for reporting to HHS, which turns on 500 or more individuals in total.
07
Secretary (HHS) notification — timeline depends on scale
Breaches affecting 500 or more individuals are reported to HHS contemporaneously with the individual notice — without unreasonable delay and no later than 60 calendar days after discovery — via the electronic breach reporting form. Breaches affecting fewer than 500 individuals must be reported no later than 60 days after the end of the calendar year in which they were discovered; a practice may report them sooner, as soon as they are discovered.
08
Business Associate notification
If a breach occurs through a Business Associate, the BA must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering the breach. The covered entity remains ultimately responsible for making sure affected individuals are notified, and may delegate delivery of those notices to the BA; a BA may also submit the report to the Secretary on the covered entity's behalf. Who performs the work should be agreed in advance, but the responsibility does not transfer. The BA's own §164.410 duty to notify the covered entity is separate and remains its own.
09
Administrative documentation
The practice must maintain proof of all breach notifications provided, document the date of the breach and the number of individuals affected, keep copies of all reports submitted to HHS, document any incidents that did not qualify as a breach (with the reasoning — typically a documented risk assessment), maintain written breach-notification policies, train staff on those policies, and have disciplinary policies in place for employees who do not follow HIPAA procedures.
What the Breach Notification Rule does
The Breach Notification Rule (45 CFR Part 164, Subpart D) requires covered entities and business associates to provide notification following a breach of unsecured PHI. "Unsecured" is the operative word: PHI encrypted or destroyed to the HHS-recognized standard is considered secured, and its exposure generally does not trigger notification obligations. Everything else is unsecured, and its exposure triggers the analysis this module walks through.
The rule creates three layers of notification: to the affected individuals, to HHS, and — for breaches affecting more than 500 residents of a state or jurisdiction — to prominent media outlets in that area. Business Associates that discover a breach must notify the Covered Entity, which then handles the downstream obligations.
Incident vs. breach — the analysis matters
An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless the covered entity or business associate demonstrates that there is a low probability that the PHI has been compromised. That demonstration is the four-factor risk assessment defined at §164.402: the nature and extent of the PHI involved, the unauthorized person who used or received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated.
The rule also identifies three specific exceptions to the definition of a breach — situations that are not breaches at all, not just breaches with a low probability of compromise. Those exceptions and the four-factor assessment are the substance of the incident-versus-breach analysis every practice runs.
The point of the analysis is not to talk your way out of notification. It is to produce a documented determination — one that names what happened, applies the framework, and reaches a defensible conclusion. Whether the answer is "this is a breach, we notified within 60 days" or "this is not a breach because of Exception 1 and here is why," the documentation is what OCR looks at during an audit.
Notification timelines and who gets notified
The 60-day clock is the same across most of the rule, but who gets notified when depends on the scale and location of the affected individuals.
| Party notified | Trigger | Timing |
|---|---|---|
| Affected individuals | Any breach of their unsecured PHI | Without unreasonable delay and no later than 60 days after discovery |
| HHS Secretary — small breaches | Breach affecting fewer than 500 individuals | Reported via the OCR portal within 60 days of the end of the calendar year in which discovered |
| HHS Secretary — large breaches | Breach affecting 500 or more individuals | Reported via the OCR portal without unreasonable delay and no later than 60 days after discovery |
| Prominent media outlets | Breach affecting more than 500 residents of a state or jurisdiction | Same 60-day clock as HHS large-breach notification |
| Covered Entity (from Business Associate) | Business Associate discovers a breach | Without unreasonable delay and no later than 60 days after discovery, unless a shorter timeline is negotiated in the BAA |
The three exceptions to "breach"
Not every impermissible use or disclosure is a breach. The rule defines three specific exceptions at §164.402 that carve out situations where notification does not apply.
Exception 1 — an unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a covered entity or business associate, in good faith and within the scope of authority, provided the PHI is not further used or disclosed in a manner not permitted by the Privacy Rule. The workforce member who opens the wrong chart, realizes immediately, and closes it without acting on the information fits here.
Exception 2 — an inadvertent disclosure of PHI from a person authorized to access it at a covered entity or business associate, to another person authorized to access PHI at the same entity or organized healthcare arrangement, provided the PHI is not further used or disclosed impermissibly. Two authorized providers within the same practice — one of whom accidentally sends a chart to the other — fits here.
Exception 3 — a disclosure where the covered entity or business associate has a good-faith belief that the unauthorized person to whom the disclosure was made would not reasonably have been able to retain the information. A chart briefly visible on a screen that the unauthorized viewer could not have read or memorized is the illustrative case.
All three exceptions require documentation. "Exception applied" without a written explanation is not a defensible position.
Documentation the rule expects
Whether the analysis concludes an incident was or was not a breach, the practice must keep records that support its determination — §164.414(b) puts the burden of demonstrating it on the practice. What the record contains depends on the route taken. If a §164.402 exclusion applied, document which one and why it fit; there was no breach to assess. If the presumption was rebutted, the four-factor assessment is the record. And if the practice simply notified without performing the assessment, that is a legitimate choice and the notice itself is the record.
For confirmed breaches, the record should include what happened, when it was discovered, the categories and count of PHI involved, the individuals affected, the notifications sent and the dates, the media notification (if applicable), the HHS submission (with reference number), and any mitigation the practice implemented — updated safeguards, workforce training, sanctions, vendor changes.
For incidents determined not to be breaches, the record should include what happened, when it was discovered, which exception applied (or the four-factor risk assessment if the low-probability standard was met), and the reasoning that led to the determination. This documentation is retained for the standard HIPAA period — six years from the date of creation.
Decision flow
What happens after a suspected HIPAA incident.
The framework practices actually run when something happens. Every step produces documentation the practice retains for six years regardless of the outcome.
- 01
Potential PHI incident occurs
A workforce member observes or is told about a situation that might involve unauthorized access, use, or disclosure of PHI. Report it through the practice's designated channel immediately.
The clock starts at discovery. Delayed reporting compresses the timeline the practice has for everything that follows.
- 02
Determine what actually happened
The Security Officer or incident lead documents the facts: what PHI was involved, how it was exposed, who was involved, when it happened, and how it was discovered.
Facts first, conclusions second. "An email may have gone somewhere" is not enough to run the analysis.
- 03
Assess whether PHI was impermissibly used or disclosed
Was the use or disclosure permitted by the Privacy Rule? If yes, this is not a breach and the analysis stops here (the incident is still documented). If no, the analysis continues.
- 04
Evaluate the three exceptions
Does the situation fit Exception 1 (unintentional workforce access in good faith), Exception 2 (inadvertent disclosure between authorized persons at the same entity), or Exception 3 (recipient could not reasonably retain the information)? If yes, document the exception and the reasoning.
- 05
Apply the four-factor risk assessment
If no exception applies, run the §164.402 four-factor risk assessment: nature and extent of PHI, who received it, whether it was actually acquired or viewed, and the extent of mitigation. Determine whether there is a low probability the PHI was compromised.
- 06
Determine notification obligations
If the analysis reaches "breach," identify the notifications required: affected individuals without unreasonable delay and no later than 60 days, HHS (contemporaneously with the individual notice when 500 or more individuals are affected, otherwise on the annual log), media (when more than 500 residents of one state are affected). If the analysis reaches "not a breach," document the reasoning and stop.
- 07
Document the entire response
Regardless of the outcome, retain the record — what happened, the analysis, the determination, the notifications (if any), the mitigation, the dates, and any policy changes. The retention period is six years from creation.
In practice
How a notification analysis actually runs
One original scenario worked through the framework end to end. This is not any specific real event — it is a composite that touches the parts of the rule workforce members actually encounter.
A billing coordinator prepares an appeal to an insurance company and attaches the wrong PDF — a claim summary for Patient B goes out with Patient A's cover letter. The coordinator realizes the mistake within an hour and contacts the insurance carrier, which confirms the PDF was deleted without being opened or forwarded.
The Security Officer opens the incident record. What happened is documented (misdirected attachment). What was involved is documented (one patient's claim summary — categories of PHI: name, DOB, insurance ID, service dates, procedure codes). Who received it is documented (the insurance carrier itself — an authorized recipient for their OWN insured, but the wrong patient here). The four-factor analysis applies: the PHI type was limited, the recipient was an authorized covered entity handling PHI routinely, the carrier attests the file was deleted without being opened or forwarded, and the practice has confirmed no further use. Documented determination: low probability of compromise; not treated as a reportable breach. The record notes the workforce member's report, the carrier's attestation (in writing), the mitigation (a workflow change to require dual-verification on attachments before send), and the completion date.
Sample knowledge check
A representative question from this module.
Sample question · 5 per module in the live series
A workforce member accidentally opens a chart for the wrong patient in the EHR, immediately realizes the mistake, and closes it without viewing further or using the information. Under the Breach Notification Rule as this module describes it, does this fall under an exception to the definition of a breach?
- A.No — any unauthorized access is automatically a breach.
- B.Yes — this fits Exception 1: unintentional acquisition, access, or use of PHI by a workforce member in good faith, within the scope of their role.
- C.Yes — but only if the workforce member reports it in writing within 24 hours.
- D.No — the three exceptions apply only to Business Associates, not to workforce members.
Show explanation
Correct answer: B. Exception 1 to the definition of a breach covers unintentional acquisition, access, or use of PHI by a workforce member, Business Associate, or someone acting under a covered entity — in good faith, within the scope of their role. The practice should still document the incident and its determination.
Common questions
Follow-up questions this module tends to raise.
Does every workforce member need to know how to run the analysis?
No. The workforce needs to know how to recognize a potential incident and how to report it. The analysis itself is run by the Privacy Officer, Security Officer, or the designated incident lead, with input from the workforce members involved. What matters is that reports actually reach that person quickly — the 60-day clock starts at discovery, and discovery is typically defined as the day the incident was known or should have been known.
What if the incident happened at a business associate?
The Business Associate must notify the Covered Entity without unreasonable delay and no later than 60 days after discovery. The Covered Entity then handles the downstream notifications to individuals, HHS, and (if applicable) the media. The BAA between the two parties can shorten the notification timeline the BA has to the CE, but not lengthen the CE's obligations to individuals or HHS.
Is there really a media notification requirement?
Yes, for breaches affecting more than 500 residents of a state or jurisdiction. The rule requires notice to prominent media outlets serving that area — typically a press release — within the same 60-day window that applies to HHS large-breach notification. Small breaches and breaches affecting fewer than 500 in-state residents do not carry a media requirement.
What is the difference between "discovery" and "knowledge"?
The rule treats a breach as discovered on the first day the breach is known to the covered entity or should reasonably have been known, exercising reasonable diligence. A workforce member who becomes aware and reports it is the practice becoming aware. "Should have been known" matters when practices delay investigation of anomalies that would have surfaced the incident sooner.
Do state breach-notification laws still apply?
Depending on the state, yes — state notification statutes and consumer-health privacy laws may impose their own obligations with different definitions, harm tests, exemptions, and notification triggers. HIPAA does not preempt more stringent state law. A practice with a reportable incident may have to notify under both HIPAA and its state's statute, sometimes on different schedules and to different regulators.
Primary sources and further reading
Where the content on this page comes from.
- 45 CFR Part 164, Subpart D — Breach Notification Rule
The full text of the rule, including the definition of breach, the exceptions, and the notification requirements.
- OCR — Breach Notification Rule guidance
Federal guidance on the notification process, the four-factor risk assessment, and reporting.
- OCR Breach Portal
The public interface where large breaches are submitted and displayed.
- Patient Protect — Breach response playbook
The operational playbook for the response process itself, from incident report through documentation.
Continue learning
Where to go next.
Previous module · 5:30
HIPAA Security Rule
Next module · 5:23
Real-World Breach Scenarios & Best Practices
Related Patient Protect resources
Breach response playbook
The step-by-step response workflow this module summarizes at a training level.
HIPAA Response — regulatory and breach intelligence tracker
The current landscape of breaches and enforcement actions, sourced and translated for independent practices.
Healthcare Breach Dashboard
Live OCR breach portal data by state, entity type, and attack pattern.
Real-world scenarios training (next module)
Ordinary workflow moments that produce breaches — and how they are prevented.
Up to 50independent practices receive one year of complete HIPAA Foundations training — free.
Selected offices receive all 19 modules, 95 knowledge checks, administrator tracking, and QR-verifiable Certificates of Completion for up to 25 personnel. No hidden conversion. No public review required. Applications close November 30.
See the initiativeModule 04 of the HIPAA Foundations series
Every learner. Every module. One office price.
When you are ready to train the whole practice, the complete 19-module HIPAA Foundations series unlocks for up to 25 personnel at $39/office/month — with per-learner assessment scores, verifiable Certificates of Completion, and workforce-wide tracking.
Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.