HIPAA Glossary · Breach & enforcement
Four-factor risk assessment
The analysis used to rebut the breach presumption after an impermissible use or disclosure of unsecured PHI.
Context
Required by §164.402. The four factors: (1) the nature and extent of the PHI involved, including identifier types and likelihood of re-identification; (2) the unauthorised person who used or received it; (3) whether the PHI was actually acquired or viewed; and (4) the extent to which the risk has been mitigated. Documented rationale against each factor is the artefact that supports a non-breach determination.
Related terms
- Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
- Unsecured PHI — PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.