HIPAA Glossary · Breach & enforcement
Breach
An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
Context
Defined at §164.402. Presumed reportable unless a risk assessment demonstrates a low probability that the PHI has been compromised. The presumption-of-breach standard dates from the 2013 Omnibus Rule and reversed the earlier "significant risk of harm" test. See [Breach Tracking](/platform/breach-tracking/).
Related terms
- Unsecured PHI — PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance.
- Four-factor risk assessment — The analysis used to rebut the breach presumption after an impermissible use or disclosure of unsecured PHI.
- Breach Notification Rule — The HIPAA regulation requiring notification of individuals, HHS, and sometimes the media following a breach of unsecured PHI.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.