HIPAA Glossary · Security Rule concepts
Safe harbor (encryption)
The breach-notification exemption: if compromised ePHI was encrypted to HHS standards and keys were not compromised, notification is generally not triggered.
Context
Established by HITECH §13402(h). The highest-leverage single technical control: encryption that meets current NIST standards and whose keys were not themselves compromised renders ePHI "secured" for breach-notification purposes. Lost encrypted laptops are a very different incident from lost unencrypted ones — the former is often not a reportable breach at all.
Related terms
- Encryption — Rendering data unreadable without a key. Addressable at rest and in transit under the Security Rule.
- Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
- Unsecured PHI — PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.