The Breach Notification Rule is the part of HIPAA that says who must be told when patient information is exposed, and by when. For most clinic staff, the job is simpler than the regulation. If something goes wrong, report it internally right away and let the privacy lead decide what happens next.
Definition
The HIPAA Breach Notification Rule requires covered entities and business associates to report breaches of unsecured protected health information (PHI) to affected patients, HHS and, for large breaches, the media. It was added to HIPAA through the HITECH Act, first as an interim final rule and later finalized in the Omnibus Rule.
In practice at a clinic or small practice
Most breaches at a practice come from ordinary slip-ups:
- A lab result is faxed or emailed to the wrong person.
- An unencrypted laptop or work phone is lost or stolen.
- A patient list or schedule is shared in a personal WhatsApp or SMS group.
- A staff member opens a chart without a work reason.
Staff should not decide alone whether an incident counts as a "breach." Report it immediately to the office manager or privacy officer through the practice's internal process. Write down what happened, when it happened, what information was involved and who received or saw it. A fast, factual report matters more than a correct legal label.
The office manager or privacy officer then runs a documented risk assessment and decides whether notification is required. They keep records of that decision even when the answer is no. Vendors that handle PHI for the practice, such as IT providers, billing companies and software vendors, are business associates. Under their business associate agreement, they must report breaches they discover to the practice.
Not to be confused with
Security incident vs. breach. Under the HIPAA Security Rule, a security incident is any attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations. A breach is narrower. It is a defined event involving unsecured PHI that can trigger notification. Every breach starts as an incident, but many incidents, such as a blocked phishing attempt, are not breaches.
FTC Health Breach Notification Rule. This is a separate federal rule for health apps and vendors of personal health records that are not covered by HIPAA. It does not apply to a clinic's HIPAA-covered records.
What the rules say
- Where it lives: 45 CFR Part 164, Subpart D, sections 164.400–164.414.
- What counts as a breach: An impermissible use or disclosure of PHI is presumed to be a breach. That presumption holds unless a risk assessment shows a low probability that the PHI was compromised. The assessment considers four factors: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated. The rule also lists exceptions, such as certain unintentional, good-faith access by workforce members.
- Unsecured PHI: PHI that has not been rendered unusable, unreadable or indecipherable to unauthorized persons. Qualifying methods include encryption or destruction that meets HHS guidance. Whether a given device or system meets that guidance has to be confirmed. It cannot be assumed.
- Individuals: Affected people must be notified without unreasonable delay and no later than 60 calendar days after the breach is discovered. The rule also sets required content and delivery methods.
- Media: Prominent media outlets must be notified when a breach affects more than 500 residents of a state or jurisdiction.
- HHS: For breaches affecting 500 or more people, HHS must be notified at the same time as individuals. Smaller breaches can be logged and reported within 60 days after the end of the calendar year.
- Business associates: A business associate must notify the covered entity after discovering a breach.
- Burden of proof and law enforcement: The covered entity or business associate must be able to show that notices were sent or that no breach occurred. Notification may be delayed at a law enforcement official's request.
- State law: State breach laws may add requirements or set shorter deadlines.
This is a plain-language summary, not legal advice. Practices should follow their privacy officer and legal counsel.
Related reading
- What information is in scope: see the PHI and ePHI entry linked in the definition above.
- The safeguards that help prevent breaches: HIPAA Security Rule.
- Vendor reporting duties and contract terms: business associate agreement (BAA).
- An example of how a vendor documents its BAA and safeguards.
More terms: Healthcare operations glossary.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.