What constitutes a reportable HIPAA breach?

Editorial team Published on

A HIPAA-reportable breach is an impermissible use or disclosure of unsecured protected health information (PHI) that compromises the security or privacy of the data, triggering mandatory notifications under the HIPAA Breach Notification Rule.

What Counts as a Breach?

  • Impermissible Use/Disclosure: Any access, use, or sharing of PHI not permitted by the HIPAA Privacy Rule.
  • Unsecured Data: Applies only to PHI that is not rendered unusable, unreadable, or indecipherable through valid encryption or complete destruction.
  • Presumption of Compromise: An incident is presumed to be a breach unless a risk assessment proves a low probability of compromise based on factors like the type of data, who received it, and mitigation efforts.

Who Must Be Notified and When?

Notifications must be made "without unreasonable delay" and no later than 60 calendar days from the date the breach was discovered (or should have been discovered through reasonable diligence).

  • Affected Individuals: Must receive written notice via first-class mail or email.
  • The Secretary of HHS:
    • For breaches affecting 500 or more individuals, notify the Secretary via the HHS online portal within 60 days of discovery.
    • For breaches affecting fewer than 500 individuals, notify the Secretary via the HHS portal within 60 days after the end of the calendar year.
  • Prominent Media: Required for breaches affecting more than 500 residents in a single state or jurisdiction.
  • Business Associates: If a business associate suffers a breach, they must notify the covered entity within 60 days.

What are the three exceptions to HIPAA breach?

Under the HIPAA Breach Notification Rule, there are three specific exceptions where an impermissible use or disclosure of Protected Health Information (PHI) is not considered a reportable breach.

The Three Exceptions

  • Unintentional Acquisition, Access, or Use of PHI: Accidental access by a workforce member in good faith and within their authority, provided there is no further unauthorized use or disclosure.
  • Inadvertent Disclosure Between Authorized Persons: An accidental disclosure by an authorized person to another individual who is also authorized to access PHI within the same organization or care arrangement, without further improper use.
  • Good Faith Belief That the Recipient Could Not Retain the Information: An impermissible disclosure where the covered entity or business associate holds a reasonable belief that the unauthorized recipient could not have retained the information.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

What are the requirements for reporting a breach?

Requirements for reporting a data or privacy breach depend heavily on the governing law and the type of data involved, but generally center around strict timelines, specific notifications, and clear content guidelines.

General Notification Requirements

  • Timing: Most laws require notification without unreasonable delay (often capped at a maximum of 60 days under rules like HIPAA Breach Notification Rule, though some state or federal financial regulations demand action within 36 to 72 hours).
  • Affected Individuals: Direct written notice (via mail or email) must be sent to all individuals whose unsecured personal or sensitive data was compromised.
  • Regulatory Authorities: Government or industry regulators (such as the U.S. Department of Health and Human Services for health data, or state Attorneys General) must be formally notified. Large breaches often have lower reporting thresholds.
  • Media Notice: If a single breach affects more than 500 residents or individuals, prominent regional media outlets must also be alerted.

Essential Content of a Breach Notice

  • Description: A plain-language summary of how the breach happened and the types of sensitive data involved.
  • Timeline: The date or estimated timeframe of the incident and its discovery.
  • Protective Actions: Clear steps the affected person should take (such as changing passwords, freezing credit, or monitoring accounts).
  • Remediation: What the organization is doing to investigate the event, contain the damage, and secure systems against future incidents.
  • Contact Info: Dedicated phone numbers, email addresses, or websites where victims can get more help.

What are the three exceptions to the definition of breach?

Under the HIPAA Breach Notification Rule, there are three specific exceptions where an impermissible use or disclosure of Protected Health Information (PHI) is not legally considered a breach:

1. Unintentional Acquisition, Access, or Use of PHI

  • What it means: An employee or authorized workforce member accesses or views PHI by accident.
  • The rules: The action must be done in good faith and remain within the scope of the person's authority. It cannot lead to further improper use or disclosure.
  • Example: A nurse quickly opens the wrong digital patient file, realizes the mistake, and closes it immediately.

2. Inadvertent Disclosure Between Authorized Persons

  • What it means: One authorized person at a healthcare organization accidentally shares PHI with another person who is also authorized to access PHI within the same organization or affiliated arrangement.
  • The rules: The data cannot be further used or disclosed in a way that violates privacy rules.
  • Example: A doctor inadvertently hands the wrong internal test result paper to a colleague who is also on the patient's care team.

3. Good Faith Belief That the Recipient Could Not Retain the Information

  • What it means: PHI is disclosed to an unauthorized person, but the organization has a reasonable, good-faith belief that the recipient could not have kept or saved the data.
  • The rules: There must be a strong indication that the recipient did not view or save the information in a permanent way.
  • Example: A staff member mistakenly mails a packet to the wrong address, but realizes the mistake and intercepts it unopened, or the recipient immediately calls back to say they shredded it unread.

HIPAA Breach Evaluation and Reporting – What is a Reportable HIPAA Breach, to Whom, and How

9 related questions found

What is considered not a HIPAA violation?

Because you didn't include the specific multiple-choice options from your test, it is not possible to point directly to one answer. However, if this is a standard quiz question, it usually looks like one of the following scenarios:

Scenario 1: A common compliance test question

If your options look like this:

  • ❌ Accessing the health record of family members or friends out of curiosity
  • ❌ Accidentally losing an unencrypted laptop containing patient files
  • 💚 Providing court-ordered health information (or providing a patient with a copy of their own records)

Correct Answer: Providing court-ordered health information or providing a patient with a copy of requested health records within the legal timeframe. HIPAA allows the disclosure of Protected Health Information (PHI) without patient consent for judicial and administrative proceedings if a direct court order is issued. Patients also have a legal right under HIPAA to access their own records.

Scenario 2: Medical training or clinical scenario

If your options look like this:

  • ❌ Leaving patient charts visible at a nurses' station
  • ❌ Discussing a patient's case with a colleague to tell an amusing story
  • 💚 Sharing patient information with another healthcare provider for the purpose of providing treatment

Correct Answer: Sharing information for treatment purposes. Under the HIPAA Privacy Rule, covered entities are fully permitted to share PHI with other doctors, specialists, or nurses who are actively treating the patient to ensure proper care.

Scenario 3: Technology and security scenario

If your options look like this:

  • ❌ Posting about a patient on social media (even without names)
  • ❌ Sending unencrypted patient data over the internet
  • 💚 Sending encrypted patient information across the internet per healthcare organization policy

Correct Answer: Sending encrypted patient information. Using approved, secure communication channels that leverage proper encryption safely protects PHI during transit and meets HIPAA Security Rule standards.

Please reply with your exact multiple-choice options if none of these match, and I will gladly tell you the precise answer!

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

What is most likely to result in a HIPAA violation?

Sharing protected health information with unauthorized individuals—such as telling friends about work details under an informal promise of confidentiality—is the specific scenario most likely to result in a direct HIPAA violation.

In broader practice and federal enforcement data, the most frequent causes of HIPAA breaches fall into a few key categories.

Most Common Causes of Violations

  • Unauthorized Access / Employee Snooping: Staff members viewing patient charts, files, or electronic records they have no clinical or professional reason to access.
  • Impermissible Disclosures: Discussing patient information in public areas, open hallways, or sharing details with people not involved in the patient's care.
  • Lost or Stolen Devices: Laptops, smartphones, tablets, or paper charts containing unencrypted patient data being misplaced or stolen.
  • Improper Disposal: Throwing paper records into regular trash bins or failing to securely wipe electronic storage media.
  • Lack of Security Safeguards: Failing to use encryption, strong passwords, or multi-factor authentication for electronic health data (ePHI).

Can normal people violate HIPAA?

No, a regular private person cannot violate HIPAA unless they work for a healthcare provider, health plan, healthcare clearinghouse, or a business partner of one of those organizations.

Who HIPAA Applies To

  • Covered entities: Doctors, hospitals, clinics, nursing homes, pharmacies, and health insurance companies.
  • Business associates: Contractors, billing companies, IT providers, or vendors who handle protected health information on behalf of a covered entity.
  • Most users on Reddit agree that a private individual without a professional healthcare role is not subject to HIPAA regulations.

When a "Regular Person" Might Seem to Violate HIPAA

  • Family and friends: If a friend or family member shares someone else's medical diagnosis, it is a bad breach of trust or an invasion of privacy, but it is not a federal HIPAA violation because they are not a medical provider.
  • Patients sharing their own info: Patients can share their own medical records anywhere they want. They cannot violate HIPAA regarding their own data.
  • Former or current healthcare workers: If an everyday person is actually a nurse, receptionist, or billing clerk who snoops on charts or blabs about a patient outside of work, they can be held liable because they work for a covered entity.

Other Legal Protections

Even though regular people cannot violate HIPAA, sharing private medical data can still break other laws. Victims can sometimes sue under state privacy laws or common-law torts for an invasion of privacy or defamation. You can learn more about how rules are applied or file a grievance through the U.S. Department of Health and Human Services.

Can you give me an example of a HIPAA violation?

A common example of a HIPAA violation is an employee looking at a patient's medical files without a job-related reason, which is often called "snooping".

Common Examples of HIPAA Violations

  • Employee Snooping: A hospital worker checks the medical chart of a neighbor, friend, or celebrity out of simple curiosity rather than an assigned care duty.
  • Misdirected Communication: A clinic worker accidentally emails lab results or texts private health details to the wrong phone number or email address.
  • Public Discussions: Medical staff talk about a patient's diagnosis or treatment details in a loud voice in a cafeteria, elevator, or waiting room where others can hear.
  • Improper Disposal: A medical office throws paper charts containing patient names and social security numbers into an ordinary trash can instead of shredding them.
  • Stolen Unencrypted Devices: A laptop or smartphone containing patient health data is stolen from an unlocked car because the device lacked proper encryption.
  • Missing Vendor Agreements: A healthcare provider hires a third-party company to digitize paper records without first signing a formal Business Associate Agreement to guarantee data protection.

You can review a full list of historic enforcement actions and penalties on the US Department of Health and Human Services case page, or read a breakdown of major penalties in the UpGuard History of HIPAA Violations.