HIPAA Glossary · Laws & rules
Breach Notification Rule
The HIPAA regulation requiring notification of individuals, HHS, and sometimes the media following a breach of unsecured PHI.
Context
Lives at 45 CFR Part 164 Subpart D. Sets the 60-day notification clock to affected individuals, HHS reporting duties (immediate for breaches of 500+ individuals in a state, annual roll-up for smaller breaches), and media notice obligations when a single state has 500+ affected residents. The clock starts at discovery.
Related terms
- Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
- Unsecured PHI — PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance.
- Four-factor risk assessment — The analysis used to rebut the breach presumption after an impermissible use or disclosure of unsecured PHI.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.