HIPAA Glossary · Breach & enforcement
Unsecured PHI
PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance.
Context
The breach-notification rule applies only to breaches of unsecured PHI. HHS has published guidance on what "secured" means — encryption that meets NIST standards, destruction methods, and so on. Encrypted ePHI with intact keys is secured; the loss of an encrypted laptop generally is not a reportable breach because the PHI on it was not unsecured.
Related terms
- Encryption — Rendering data unreadable without a key. Addressable at rest and in transit under the Security Rule.
- Safe harbor (encryption) — The breach-notification exemption: if compromised ePHI was encrypted to HHS standards and keys were not compromised, notification is generally not triggered.
- Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.