Section § 164.402Definitions

What it says

As used in this subpart, the following terms have the following meanings:

Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

(1) Breach excludes:

(i) Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part.

(ii) Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part.

(iii) A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

(2) Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

(i) The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;

(ii) The unauthorized person who used the protected health information or to whom the disclosure was made;

(iii) Whether the protected health information was actually acquired or viewed; and

(iv) The extent to which the risk to the protected health information has been mitigated.

Unsecured protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111-5.

HIPAA, the United States rules protecting health information, § 164.402

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• PPTPowerPoint

  HIPAA Management Briefing Deck

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Tells leaders what HIPAA asks of security, what must be shown, and the six decisions needed from them.
• XLSExcel

  Incident Classification, Severity & Escalation Matrix

  in Security Incident ManagementIts Framework References cite this section. Classifies events by impact criteria and maps each severity to escalation paths, notification triggers and response-time targets.
• DOCWord

  Ransomware Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Covers containment, recovery sequencing, extortion decisions and regulatory triggers specific to a ransomware event.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• PPTPowerPoint

  Tabletop Scenario — Health Data Breach and the 60-Day Clock

  in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References cite this section. Inject deck and facilitator notes testing the HIPAA breach assessment, discovery against declaration, the business associate chain and State-law notices on a 60-day clock.
• DOCWord

  Reportability Decision Model

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Structured decision tree for whether an incident is significant, major or notifiable, with the reasoning recorded.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.