HIPAA Glossary · Breach & enforcement
Security incident
Attempted or successful unauthorised access, use, disclosure, modification, or destruction of information — or interference with operations.
Context
Defined broadly at §164.304. The scope is intentionally wider than "breach": every failed login attempt, phishing email, port scan, and malware detection is a security incident. All incidents must be logged (§164.308(a)(6)); few become breaches. The breadth is why §164.308(a)(6)(ii) is operationally about logging, not investigation of every entry.
Related terms
- Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
- Administrative safeguards — The management layer of the Security Rule — risk analysis, workforce security, training, incident procedures, contingency planning, evaluation.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.