Breach Assessment & Notification Decision Procedure

Privacy lead

Runs the Privacy Rule duties and, with the security official, the breach assessment. Tests the exclusions, writes the record, signs it, hands it over and keeps it.

Security official

Fixes the time of discovery with the incident manager, judges whether the PHI was secured, assesses the four factors with the privacy lead, signs the record and checks it is complete.

Incident manager (P09)

Opens and runs the case, records the time of discovery under IM-13, and links the record to the case.

ePHI system owner

Supplies the facts about the system and the data: what it held, who could reach it, what the logs show.

IT lead

Supplies the technical evidence: encryption state, key custody, logs, the recovery or wipe.

Legal counsel

Confirms the role, the contract terms and any breach decision. Is asked before a decision rests on an exclusion that involves an outside party, or on a recipient's assurance.

Executive sponsor

Decides to report where P09 gives the decision to the executive (HD-06). Receives the signed record.

Inputs

The report of the event, from whoever raised it; the P09 case (opened by P09-A05); the log or message that shows when anyone first knew.

Who

The incident manager opens the case (P09). The security official fixes the time of discovery with the incident manager.

Output

A case number; a time of discovery, separate from the time of declaration.

What to record

Who first knew, what they knew, and when. If anyone in the workforce, or any agent, would have known earlier by reasonable diligence, say so and use that earlier time. The person who committed the breach does not count.

Inputs

The facts so far; the data involved; the agreement or the Privacy Rule policy that says what use or disclosure was permitted.

Who

The privacy lead decides, with the security official. Counsel is asked if the answer is not plain.

Output

Two answers, each with a reason: was PHI involved, and was the acquisition, access, use or disclosure one that Subpart E does not permit.

What to record

What the data was, whose it was, what use or disclosure was permitted and why this one is outside it. If you stop here, write down why, and file the case as a security incident (HR-17).

Inputs

The encryption status of the device, database, file or message; the key custody record; the destruction record for any media; logs that show the state at the time.

Who

The IT lead gives the facts and the evidence. The security official decides whether they follow the HHS guidance. The privacy lead records it.

Output

Secured or not secured, and how it is known.

What to record

The method (encryption or destruction); the evidence; where the key was and who could reach it; the date and time the state was checked; any doubt. Keep copies of the evidence, not a pointer to a system that changes.

Encryption of data at rest

Was the PHI encrypted as the Security Rule defines encryption (an algorithmic process that makes a low probability of assigning meaning without a confidential process or key), in a way consistent with NIST SP 800-111, which the HHS guidance names for data at rest? Full-disk encryption may render the data unreadable while the device is powered down: HHS says many solutions decrypt files transparently once the device is on and the operating system is loaded, so record whether the device was shut down, and how you know.

The encryption status report from before the event, the configuration, the product and version, the date the status was last confirmed.

Encryption of data in motion

Was the PHI sent over a channel that follows NIST SP 800-52, SP 800-77 or SP 800-113, or that is FIPS 140-2 validated, as the HHS guidance names? An email attachment that was not encrypted does not meet this.

The transport configuration or the message settings, and the log of the transmission.

The key was not breached

Was the confidential process or key that could decrypt the data not breached? The guidance says the means to decrypt should be kept on a device or at a location separate from the data.

Where the key was kept, who could reach it, whether it was on the lost device or in the same place as the data, and any sign that it was exposed.

Destruction of paper, film or other hard copy

Was the hard copy shredded or destroyed so that the PHI cannot be read or reconstructed? Redaction is specifically excluded as a means of destruction.

The destruction record, the method and the date.

Destruction of electronic media

Were the media cleared, purged or destroyed consistent with NIST SP 800-88, so that the PHI cannot be retrieved?

The sanitisation record or log, the method, the media identifiers.

Inputs

The facts, written as a short timeline; the identity and role of everyone who touched the PHI; what each did next.

Who

The privacy lead tests each exclusion with the security official. Counsel confirms before an exclusion is relied on for an event with outside recipients.

Output

An exclusion that applies, with the facts it rests on; or none applies.

What to record

For each exclusion considered: the facts that fit, the facts that do not, and the decision. Each exclusion needs written facts. For the first two, record that nothing further was done with the PHI that the Privacy Rule does not permit, and how that is known; for the third, record why the person could not reasonably have retained it.

Facts needed

• The act was unintentional: the person did not mean to get at that PHI.

• The person is a workforce member or acts under the authority of the covered entity or business associate.

• They acted in good faith and within the scope of their authority (the role they had, and the task they were doing).

• Nothing further was done with the PHI that the Privacy Rule does not permit: no use, no disclosure, no copy kept.

Stops it applying

Curiosity or snooping; access beyond the role; a copy taken; a later disclosure.

Facts needed

• The disclosure was inadvertent.

• Both the sender and the receiver are authorised to access PHI at the same covered entity or business associate, or in the same organised health care arrangement in which the covered entity takes part.

• The receiver did not use or disclose it further in a way the Privacy Rule does not permit.

Stops it applying

A receiver at another organisation, even a related one that is not in the same arrangement; a receiver who is not authorised to see PHI at all; onward forwarding.

Facts needed

• A disclosure to a person who was not authorised.

• You held a good faith belief that the person could not reasonably have retained the information.

• The belief rests on facts you can write down: for example, the sheet was handed back at once, unread, or the page was shown for a moment and recovered.

Stops it applying

Anything that was sent, posted, left on a system or kept; a belief without a reason; a person who could take a photo or a copy.

Inputs

Everything from BP-01 to BP-04; the evidence for each factor (see the table of factors); the mitigation steps and their proof.

Who

The privacy lead and the security official, jointly. The system owner and the IT lead supply facts. Counsel reviews the rating when the event involves outside parties.

Output

A written assessment of the four factors, each with its facts and a rating, and a statement of whether low probability of compromise is demonstrated.

What to record

The facts for each factor, where each fact came from, the rating, and the reasoning that links the four ratings to the conclusion. A factor you cannot assess is recorded as not known, and counts against demonstrating low probability.

Ask

What types of identifiers were involved, and how likely is re-identification?

• Which identifiers were there: name, address, date of birth, account or member number, contact details, device identifiers?

• Which health information was there: diagnosis, treatment, appointment, payment, or only the fact that the person is a patient of a particular provider?

• How many individuals and how many records? Can the data be matched to a person by someone who has the file alone, or with other information they are likely to hold?

Evidence to record

A sample or a field list of the data (not a copy kept loosely), the count of individuals, and a note of which fields identify a person.

Points to Higher

Direct identifiers together with health context; the file names the provider; a large or sensitive set.

Points to Lower

Identifiers were removed or cannot be tied to a person by anyone who has the file; the data cannot reasonably be re-identified.

Ask

Who used the information or received it, and are they bound by HIPAA or another duty of confidentiality?

• Who used the PHI or received it: a person, an organisation, a system, or the public?

• Are they bound by HIPAA or by another duty of confidentiality, for example a covered entity, a business associate, a health professional, or a party to a written agreement?

• Did they act in good faith, and did they tell you at once?

Evidence to record

The recipient's identity and role, the duty that binds them (contract, licence, professional rule), and their own words: the message or call note in which they reported it.

Points to Higher

The recipient is unknown, hostile, or free to publish; the data was public or taken by an attacker.

Points to Lower

The recipient is bound by HIPAA or an equal duty, is known, and acted properly.

Ask

Was the information actually acquired or viewed, or only exposed?

• Was the PHI actually opened, read, copied, downloaded or taken, or was it only exposed so that someone could have reached it?

• What proves it either way: access logs, file metadata, mail or download records, the recipient's account?

Evidence to record

The log extract, the date and time of each access, and the retention of the logs. If there are no logs, say so.

Points to Higher

The logs show access or download, or there are no logs to show that it did not happen.

Points to Lower

A forensic review shows the data was reachable but was not opened, and the review's basis is kept.

Ask

To what extent has the risk been reduced: written assurance of deletion, a recovered device, a retrieved file?

• What was done to reduce the risk, and when: a deletion confirmed, a device recovered, a file retrieved, an account closed, access removed?

• Is there written assurance from the recipient, and can it be relied on? What did the person who gave it have the ability to do?

Evidence to record

The written assurance, the recovery record, the time of each step, and an account of the gap between the event and the step.

Points to Higher

No assurance; assurance from someone with no control of the copies; a long gap in which onward use cannot be ruled out.

Points to Lower

A prompt, documented recovery or a credible written assurance from a bound recipient, with the gap accounted for.

Higher

This factor raises the probability that the PHI has been compromised.

Lower

This factor lowers that probability and the evidence for it is on the record.

Mixed

Facts point both ways. Say which, and weigh them in the reasoning.

Not known

The facts are not available. This is not a Lower.

Inputs

The completed record.

Who

The privacy lead and the security official sign. The decision to report follows P09's decision rights (HD-06).

Output

One of the five outcomes, BO-1 to BO-5, signed and dated.

What to record

The outcome, the date and time signed, both signatures, and a link to the P09 case. Where the signers disagree, the more cautious outcome stands until counsel and the P09 decision-maker have resolved it, and the disagreement is written down.

Inputs

The signed record; the P09 case; the hand-over list below.

Who

The privacy lead hands over. For a covered entity the notices are drafted and approved under P18-A09 and P18-A10 and P09's decision rights. For a business associate the notice to the covered entity is drafted from A05's BT-06 content.

Output

The hand-over, dated and received by a named person.

What to record

What was passed, to whom, the date and the time, and any part that was still unknown, so the notification procedure knows what to complete.

Inputs

The record, the evidence, the notices as sent, and any later change to the decision.

Who

The privacy lead keeps the record. The security official checks that it is complete before the case is closed.

Output

A closed case with a retention date.

What to record

The date the record was created, the last date it was in effect, and the date the retention period ends (HR-13). A change to the decision creates a new dated record; the old one is kept.

1 Was there an acquisition, access, use or disclosure of protected health information that Subpart E does not permit? (BP-02)

Go to 2.

BO-1. Not a breach. A security incident, documented (HR-17).

2 Was the PHI secured: encrypted or destroyed as the HHS guidance describes, with the key not breached? (BP-03)

BO-2. Not a breach of unsecured PHI.

Go to 3.

3 Does one of the three exclusions apply, on facts that are written down? (BP-04)

BO-3. Excluded.

Go to 4. The event is presumed to be a breach.

4 Have the four factors been assessed on the facts, and do they demonstrate a low probability that the PHI has been compromised? (BP-05)

BO-4. Low probability demonstrated.

BO-5. A breach of unsecured PHI.

BO-1

Not a breach: no impermissible use or disclosure

File the record with the P09 case. Handle the security incident under P09. No notification duty of Subpart D. A business associate also checks what its agreement asks it to report (A05 BT-04, BT-05), because that duty can exist where Subpart D asks for nothing.

BO-2

Not a breach of unsecured PHI: the PHI was secured

File the record with the evidence of encryption or destruction. Handle the security incident under P09. No notification duty of Subpart D. A business associate also checks what its agreement asks it to report (A05 BT-04, BT-05), because that duty can exist where Subpart D asks for nothing.

BO-3

Excluded: one of the three exclusions applies

File the record with the facts the exclusion rests on. Fix the cause. No notification duty of Subpart D. A business associate also checks what its agreement asks it to report (A05 BT-04, BT-05), because that duty can exist where Subpart D asks for nothing.

BO-4

Low probability of compromise demonstrated on the four factors

File the record. It is your proof (164.414(b)). Fix the cause. Review the record if new facts arrive, because they can reverse the conclusion. A business associate also checks what its agreement asks it to report (A05 BT-04, BT-05), because that duty can exist where Subpart D asks for nothing.

BO-5

Breach of unsecured PHI: notify under P09 RD-17 to RD-20

Hand over (BP-07). A covered entity moves to P18-A09 and P18-A10 and P09 RD-17 to RD-19; a business associate notifies the covered entity (P09 RD-20).

Who assesses?

The covered entity: its privacy lead with the security official. It has the burden of proof (164.414(b)).

The business associate: its privacy lead with the security official. It has the burden of proof too (164.414(b)). The agreement says who decides, and counsel confirms it.

Who is told when the decision is a breach of unsecured PHI?

The individuals, the media where the threshold is passed, and the Secretary (P09 RD-17 to RD-19).

The covered entity it serves, with each individual identified (P09 RD-20; 164.410). A subcontractor tells the business associate that engaged it, as its agreement requires; that business associate then has its own duty to the covered entity.

When does the clock start?

At discovery by the covered entity (P09 IM-13; 164.404(a)(2)). If the business associate is the covered entity's agent, what it knows counts as the covered entity's own knowledge; counsel confirms.

At discovery by the business associate (P09 IM-13; 164.410(a)(2)). The covered entity's own clock has its own start, and the agreement may tie them together.

What does the agreement add?

Its agreements with its business associates say what they must report and when. A report from a business associate starts a question for the covered entity: when did it learn of it (counsel confirms)?

The agreement may ask for more than the Rule: every security incident, or every impermissible use or disclosure, and not only breaches (A05, BT-04 and BT-05). Report what the agreement asks even where the assessment says the event is not a breach.

Case number

[[The P09 case number. One record per event.]]

Our role in this case

[[Covered entity or business associate. For a business associate, name the covered entity the PHI belongs to.]]

Time of discovery

[[The time recorded under P09 IM-13, and who knew first.]]

Date and time of the event

[[When the acquisition, access, use or disclosure happened, if known.]]

Facts

[[What happened, in plain words, as a timeline. Only facts. Mark what is not yet known.]]

Was PHI involved?

[[Yes or No, with the data and the individuals' relationship to the provider.]]

Permitted by Subpart E?

[[Yes or No, with the use or disclosure that was permitted and the reason this one is inside or outside it.]]

Secured or not, and how it is known

[[Secured (method and evidence) or Unsecured. If secured, the key's location.]]

Exclusion considered

[[HX-01, HX-02, HX-03 or None. The facts for and against.]]

HF-01 nature and extent: facts, evidence, rating

[[Facts and where each came from; the evidence kept; a rating: Higher, Lower, Mixed or Not known.]]

HF-02 the unauthorised person: facts, evidence, rating

[[Facts and where each came from; the evidence kept; a rating.]]

HF-03 acquired or viewed: facts, evidence, rating

[[Facts and where each came from; the evidence kept; a rating.]]

HF-04 mitigation: facts, evidence, rating

[[Facts and where each came from; the evidence kept; a rating.]]

Decision

[[BO-1 to BO-5, and the reasoning in one paragraph.]]

Number of individuals and where they live

[[The count and the State of each, where known. P18 and P09 need it.]]

Signature: privacy lead

[[Name, date and time.]]

Signature: security official

[[Name, date and time. Counsel too, where the steps ask for review.]]

Link to the P09 case

[[Where the case is kept.]]

Handed to P18 on

[[Date and time, and who received it. Or: not applicable (BO-1 to BO-4).]]

Retain until

[[The end of six years from creation or the last date in effect, whichever is later (HR-13).]]

Case number; our role

INC-2026-031 (EXAMPLE). Assessment record BX-1. A business associate. The PHI belongs to the clinic customer whose records were exported (EXAMPLE).

Time of discovery (P09 IM-13)

2026-09-08 at 14:05. Nobody in the organisation knew before the recipient's reply.

Facts

On 2026-09-08 at 09:40 a support agent exported 1,214 appointment records for one clinic customer (patient names, appointment dates, clinic name, phone numbers; no clinical notes) and emailed the file to an administrator at a different clinic customer. The recipient replied at 14:05 the same day to say the file was not theirs. The file was not encrypted.

Event: 2026-09-08, about 09:40 (the export was sent)

Was PHI involved? Permitted by Subpart E?

Yes. Patient names, appointment dates, the clinic's name and phone numbers. No clinical notes.

No. The export was for the first clinic. Sending it to a different clinic customer is not a use or disclosure the agreement with the first clinic allows.

Secured or not, and how it is known

Not secured. The file was not encrypted and was sent by email in the clear.

Exclusion considered

HX-01 does not fit: the disclosure left the organisation. HX-02 does not fit: the recipient is at a different customer, not at the same entity. HX-03 does not fit: the file was opened and kept for about five hours.

HF-01 The nature and extent of the information

Names, phone numbers and appointment dates with the clinic's name show that each person is a patient of that clinic. Re-identification is certain.

Rating: Higher

HF-02 The unauthorised person

An administrator at another customer, who works for a covered entity and is bound by HIPAA and by the platform's terms. The recipient deleted the file and confirmed in writing at 15:30.

Rating: Lower

HF-03 Acquired or viewed

The file was opened: the recipient described its contents.

Rating: Higher

HF-04 Mitigation

Deletion was confirmed in writing, but the file sat in a mailbox and a laptop for about five hours and its onward use cannot be shown.

Rating: Mixed

Decision

BO-5 Breach of unsecured PHI: notify under P09 RD-17 to RD-20.

The recipient is bound and acted properly, which lowers the second factor, but the data identifies each person as a patient of a named clinic, the file was opened, and deletion cannot show that the file was not used or copied in the five hours it was held. Low probability of compromise is not demonstrated, so the event stays a breach of unsecured PHI.

Number of individuals and where they live

1,214 individuals, patients of the clinic customer whose data it was. States of residence: [[taken from the customer's list]]

Evidence kept

The recipient's reply of 14:05 and the written confirmation of deletion at 15:30.

The support platform's export log and the mail log for the message.

Signatures

Privacy lead: Priya Nair (EXAMPLE), Privacy Lead, signed 2026-09-09

Security official: Max Okafor (EXAMPLE), Head of Information Security, signed 2026-09-09

Link to the P09 case; handed to P18 on

INC-2026-031 in the case log (EXAMPLE). Handed to P18: 2026-09-09, to the notification lead (EXAMPLE), for the notice to the covered entity (P09 RD-20)

Retain until

2032-09-09 (six years from 2026-09-09; HR-13). Fix the cause: Exports to email are blocked unless the file is encrypted, and the support role's export right is reviewed (P07-A02).

Case number; our role

INC-2026-034 (EXAMPLE). Assessment record BX-2. A business associate. The PHI belongs to the clinic customer whose record it was (EXAMPLE).

Time of discovery (P09 IM-13)

2026-09-15 at 11:20. The engineer told the security official on the same day.

Facts

On 2026-09-15 a support engineer opened a patient's appointment record in the course of a ticket, to reproduce a scheduling fault, and saw it was for a different clinic than the ticket. The engineer closed it at once and told the security official. The engineer is authorised to access appointment records for troubleshooting.

Event: 2026-09-15, shortly before 11:20 (the record was opened)

Was PHI involved? Permitted by Subpart E?

Yes. One appointment record: name, appointment date and the clinic's name.

Treated as not permitted, to be safe: the ticket concerned a different clinic. The engineer's access to appointment records for troubleshooting is permitted; whether this record was within the ticket is the question.

Secured or not, and how it is known

Not secured. The record was viewed on screen as the engineer's authorised role allows.

Exclusion considered

HX-01. HX-01 applies. Unintentional: the engineer opened it while reproducing a fault. Workforce member acting under the organisation's authority. Good faith and within the scope of authority: the engineer's role allows access to appointment records for troubleshooting, and the engineer closed it at once and reported it. No further use or disclosure: the access log shows one view and no export, and the engineer made no copy. HX-02 and HX-03 were not needed.

HF-01 The nature and extent of the information

Not assessed: an exclusion applies.

HF-02 The unauthorised person

Not assessed: an exclusion applies.

HF-03 Acquired or viewed

Not assessed: an exclusion applies.

HF-04 Mitigation

Not assessed: an exclusion applies.

Decision

BO-3 Excluded: one of the three exclusions applies.

An exclusion applies, so the four factors are not needed to reach the outcome. They are not assessed. If the facts change (for example, a copy is found), the exclusion falls and BP-05 is done.

Number of individuals and where they live

1 individual. Not told: the exclusion applies.

Evidence kept

The access log extract for the one view.

The engineer's written account, and the security official's note of the conversation.

Signatures

Privacy lead: Priya Nair (EXAMPLE), Privacy Lead, signed 2026-09-15

Security official: Max Okafor (EXAMPLE), Head of Information Security, signed 2026-09-15

Link to the P09 case; handed to P18 on

INC-2026-034 in the case log (EXAMPLE). Handed to P18: Not applicable (BO-3)

Retain until

2032-09-15 (six years from 2026-09-15; HR-13). Fix the cause: A reminder to support staff on what a ticket's scope allows is added to the next training (P16-A02).

Case number; our role

INC-2026-037 (EXAMPLE). Assessment record BX-3. A business associate. No Subpart D notice follows; the customer agreement is checked for a duty to report this kind of event (A05 BT-04).

Time of discovery (P09 IM-13)

2026-09-22 at 18:05. The engineer reported the loss and the device was found missing at this time.

Facts

On 2026-09-22 an engineer lost a laptop on a train. It held cached appointment data. Full-disk encryption was on, the engineer confirmed the laptop was shut down before it was lost, the key was held in the endpoint management system and not on the device, and the device was remotely wiped within the hour. The log shows the wipe ran.

Event: 2026-09-22, an hour or so before 18:05 (the laptop was lost)

Was PHI involved? Permitted by Subpart E?

Yes. Cached appointment data on the laptop.

Treated as not permitted: loss of the device could allow an unauthorised person to acquire the data.

Secured or not, and how it is known

Secured. Full-disk encryption was on, confirmed by the endpoint management report from the morning of the loss. The key was held in the endpoint management system, not on the device. The remote wipe ran within the hour and the log shows it. The engineer reports the laptop was shut down; the management log shows no unlock after the loss.

Exclusion considered

Not considered: the event is secured at BP-03, so BP-04 is not reached.

HF-01 The nature and extent of the information

Not assessed: the PHI was secured.

HF-02 The unauthorised person

Not assessed: the PHI was secured.

HF-03 Acquired or viewed

Not assessed: the PHI was secured.

HF-04 Mitigation

Not assessed: the PHI was secured.

Decision

BO-2 Not a breach of unsecured PHI: the PHI was secured.

The encryption is the kind the HHS guidance describes for data at rest, the key was not on the device and there is no sign it was breached, so the PHI was not unsecured. The notification duties of Subpart D do not apply. It is a security incident (HR-17).

Number of individuals and where they live

Not applicable: secured PHI.

Evidence kept

The endpoint management encryption report, with the date it was run.

The key custody record, and the wipe log.

The security official's check of the current edition of the NIST publication the guidance names.

Signatures

Privacy lead: Priya Nair (EXAMPLE), Privacy Lead, signed 2026-09-23

Security official: Max Okafor (EXAMPLE), Head of Information Security, signed 2026-09-23

Link to the P09 case; handed to P18 on

INC-2026-037 in the case log (EXAMPLE). Handed to P18: Not applicable (BO-2)

Retain until

2032-09-23 (six years from 2026-09-23; HR-13). Fix the cause: The lost-device step in the offboarding of travelling staff is reviewed (P13-A02).

The signed Breach Assessment Record

It is the proof that the event was assessed, and the basis of every notice.

The case number and the link to the P09 case

So the notices, the log and the record agree.

The time of discovery (P09 IM-13)

Every clock runs from it. It is passed exactly as P09 recorded it, not recalculated.

Our role in this case, and the covered entity (for a business associate)

It tells P18 which notices are ours and who the business associate notifies (P09 RD-20).

The date of the breach, if known, and a short description of what happened

The content of a notice to individuals starts with them (164.404(c)).

The types of unsecured PHI involved

A notice describes them (164.404(c)); a business associate gives them to the covered entity (164.410(c)).

Each individual affected, with contact details where held, and the State of residence

A business associate must identify each individual (164.410(c)). A covered entity needs the counts and States for P09 RD-18 and RD-19 and the State laws in P18-A09.

What has been done and what is planned to reduce harm and prevent a repeat

A notice describes it (164.404(c)). It also forms HF-04.

Any statement from a law-enforcement official, with who, when and in what form

It decides whether P09 DL-01 applies. Pass it exactly as received.

What is still unknown

So P18 completes it. A business associate gives further information promptly as it becomes available (164.410(c)).

Everyone in the workforce: what to report, and to whom, at once

The awareness plan (P16-A02)

All staff

The privacy lead and the security official: the four factors and the exclusions on a real record

A walk through BX-1 to BX-3, then a practice case from your own history

Privacy lead, security official, deputies

The decision, from a call to a signature, under pressure

The tabletop scenario SC-07 in P10-A13, with this record filled in during the exercise

Privacy lead, security official, incident manager, counsel, executive sponsor

PF-5

Calling an incident 'not a breach' without a written record of why: an exclusion, secured PHI, or the four-factor assessment.

Write the assessment. The four factors, the facts for each, the rating, the decision, and the signatures. A decision without the record is not shown.

BPF-1

Starting the clock when the assessment finishes.

The time of discovery is fixed at BP-01 and does not move (P09 IM-13). Do not wait for the assessment to be perfect: the clock does not.

BPF-2

Rating a factor Lower because nothing bad is known.

Not known is not Lower. Write Not known, and let it count against demonstrating low probability.

BPF-3

Relying on a recipient's word that the file was deleted.

Ask who the recipient is, what they could have done in the time, and whether the word is in writing. Record that, not only the word.

BPF-4

Treating encryption as secure without checking the key.

Record where the key was and who could reach it. A key on the lost device needs a recorded reason to believe it was not compromised.

BPF-8

A business associate deciding that no breach means nothing to tell the customer.

The agreement may ask for every security incident or impermissible use (P31-A05 BT-04, BT-05). Report what the agreement asks.

State breach laws, and the notice content and timing they set

P18-A09 (the matrix) and P18-A10 (the templates). State laws are different from HIPAA's, and some cover information HIPAA does not.

SEC, New York DFS and FTC notifications

P18-A09 and P18-A10.

The Privacy Rule: which uses and disclosures are permitted, minimum necessary, and individuals' rights

Your Privacy Rule policies and counsel. The Security Rule safeguards are in P31-A03.

The notification clocks, the media and Secretary thresholds, the content and methods of notices

P09 RD-17 to RD-20, and P18-A09 and P18-A10.

Incident handling: triage, severity, containment, eradication, recovery

P09 (the incident response plan and playbooks).

Other regimes: GDPR, NIS2, DORA, and the law of any other country

P09 and P18, if you are subject to them.

P09-A03 Incident Response Plan

Declaration, severity, the time of discovery (IM-13) and the decision rights

P09-A05 Incident Triage & First-Hour Assessment Procedure

The first-hour triage that opens the case this procedure follows

P18-A09 US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

The US notification clocks and thresholds, by regime, and the Clock Calculator

P18-A10 US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

The US notices drafted after BO-5

P31-A05 Business Associate Agreement Security Terms

BT-04 to BT-06: what a business associate reports to the covered entity and what the report contains

P31-A03 Security Rule Safeguard Register

The Security Rule safeguards: the evidence for encryption, logging and access that BP-03 and BP-05 rely on

ISO/IEC 27001:2022

Annex A 5.25 — Assessment and decision on information security events

The decision at BP-06: assessing an information security event and deciding whether it is an incident

NIST CSF 2.0

RS.MA-02 — “Incident reports are triaged and validated”

BP-01 to BP-06: incident reports are triaged and validated

HIPAA — 45 CFR Parts 160 and 164

§ 164.304 — defines the terms the Security Rule uses, among them “Availability”, “Confidentiality”, “Integrity”, “Encryption” (“the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key”), “Malicious software” and “Security incident” (“the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system”)

BP-01 and BP-02: security incident, and why most security incidents are not breaches

HIPAA — 45 CFR Parts 160 and 164

§ 164.402 — a “breach” is “the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information”. Three exclusions are listed. Otherwise the event “is presumed to be a breach unless” the covered entity or business associate “demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors”: the nature and extent of the information, the unauthorized person who used it or received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. “Unsecured protected health information” is information not rendered unusable, unreadable or indecipherable through a technology or methodology the Secretary specifies in guidance

BP-02 to BP-05: the breach definition, the three exclusions, the presumption, the four factors and unsecured PHI

HIPAA — 45 CFR Parts 160 and 164

§§ 164.404 to 164.412 — after “discovery of a breach of unsecured protected health information” a covered entity notifies the individuals affected (§ 164.404), prominent media outlets where the threshold is passed (§ 164.406) and the Secretary of Health and Human Services (§ 164.408); a business associate notifies the covered entity and identifies each individual affected (§ 164.410); a law enforcement official’s statement can delay a notice (§ 164.412). Each section sets its own time limit and content. This pack does not restate them: P09 RD-17 to RD-20 and P18-A09 and P18-A10 hold them

BP-07: who is told after BO-5, and what the hand-over carries; the clocks are P09's and P18's

HIPAA — 45 CFR Parts 160 and 164

§ 164.414 — the covered entity applies the administrative requirements of § 164.530 to the breach rules, and “In the event of a use or disclosure in violation of subpart E, the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach”

BP-05, BP-06 and BP-08: the burden of demonstrating that the event was not a breach

HHS Office for Civil Rights guidance

Guidance specifying the technologies and methodologies that render protected health information unusable, unreadable or indecipherable (74 FR 42740, at 42742 to 42743, 24 August 2009 (the guidance names FIPS 140-2, which NIST has replaced with FIPS 140-3 for new validations: check which your product holds), which reissued the guidance first published for comment at 74 FR 19006, 27 April 2009; HHS page content last reviewed 26 July 2013): protected health information is rendered so if electronic information “has been encrypted” as the Security Rule defines and the confidential process or key “has not been breached”, with valid encryption for data at rest consistent with NIST SP 800-111 and for data in motion complying with NIST SP 800-52, SP 800-77 or SP 800-113 or FIPS 140-2 validated; or if the media have been destroyed (paper shredded or destroyed; “Redaction is specifically excluded”; electronic media cleared, purged or destroyed consistent with NIST SP 800-88). The NIST editions it names may have been revised since

BP-03: what secured PHI is

HHS Office for Civil Rights guidance

“Fact Sheet: Ransomware and HIPAA” (content last reviewed 20 September 2021): when ePHI is encrypted as the result of a ransomware attack, “a breach has occurred because the ePHI encrypted by the ransomware was acquired”, and a breach is presumed unless the covered entity or business associate demonstrates a low probability of compromise on the Breach Notification Rule's factors. Whether ePHI that was already encrypted consistent with the unsecured-PHI guidance is a reportable breach is, HHS says, a fact-specific determination. It is guidance, not a rule

BP-02: malicious software that encrypts or takes control of ePHI counts as an acquisition

HIPAA — 45 CFR Parts 160 and 164

§ 164.530(j) — a covered entity must “retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later”; § 164.414(a) applies this administrative requirement to the breach notification rules

BP-08: retention of the record for six years

Breach

An acquisition, access, use or disclosure of PHI not permitted under the Privacy Rule that compromises its security or privacy (164.402), subject to three exclusions and the presumption the definition sets.

Discovery

The first day a breach is known to the organisation or would have been known by reasonable diligence, counting what any workforce member or agent knows other than the person who committed it (164.404(a)(2); 164.410(a)(2)). Recorded as the time of discovery under P09 IM-13.

Four factors

The assessment of at least the nature and extent of the information; the unauthorised person; acquired or viewed; mitigation (164.402).

Security incident

An attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations (164.304). Most security incidents are not breaches.

Unsecured PHI

PHI that has not been rendered unusable, unreadable or indecipherable through a method HHS specifies in guidance, such as encryption with the key kept safe, or destruction.