What Is a Breach?
A breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI. The HITECH Act created a presumption that any impermissible use or disclosure is a breach unless the covered entity demonstrates a low probability that the PHI has been compromised based on a four-factor risk assessment.
Breach Notification Requirements
| Notification | To Whom | Deadline |
|---|---|---|
| Individual notification | Each affected individual | Within 60 days of discovery |
| HHS notification (large breach) | HHS (if 500+ individuals) | Within 60 days of discovery |
| Media notification | Prominent media outlet in affected state (if 500+ in a state) | Within 60 days of discovery |
| HHS notification (small breach) | HHS annual log | Within 60 days of end of calendar year |
Breach Penalties
Watch Out
HIPAA breach penalties are tiered based on culpability. Violations due to willful neglect that are not corrected carry penalties of $50,000 per violation, up to $1.9 million per violation category per year. The HHS Office for Civil Rights has assessed multi-million dollar penalties against covered entities for breach notification failures. A breach response plan is not optional — it is essential.