The word "breach" gets thrown around too casually

Someone on your team hits "reply all" on an email that includes a patient's name. A laptop goes missing from a car. A fax lands at the wrong number. In the moment, everyone panics and calls it a breach. Sometimes it is. Often it isn't, at least not in the way HIPAA defines the term. The distinction matters because the wrong label triggers the wrong response, and the wrong response is what regulators actually notice.

I want to walk through how to tell an incident from a breach in practical terms, what your obligations look like at each step, and how to keep the documentation trail that will save you if OCR ever knocks. This isn't legal advice. Confirm the specifics with your own counsel and your privacy officer. But you should be able to make the initial call at the desk when it happens.

The definitions that actually matter

A security incident, under the Security Rule, is any attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations. That is a broad net on purpose. A failed login attempt is technically an incident. A phishing email that nobody clicked is an incident. You are not required to notify anyone about most incidents, but you are required to identify them, respond to them, and document what happened.

A breach is narrower. It's the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of that PHI. The key word is "unsecured." Properly encrypted PHI that gets exposed generally does not trigger breach notification, because it isn't readable. That's why encryption at rest and in transit is worth every hour you spend on it.

Between those two sits the gray zone where most real events live: something happened, PHI may have been touched, and you need to figure out whether it rises to the breach threshold.

The four-factor risk assessment

When an event involves PHI going somewhere it shouldn't, HIPAA presumes it is a breach unless you can demonstrate a low probability that PHI was compromised. You demonstrate that through a documented risk assessment covering four factors:

  • The nature and extent of the PHI involved, including identifiers and the likelihood of re-identification.
  • The unauthorized person who used the PHI or to whom the disclosure was made.
  • Whether the PHI was actually acquired or viewed, or only potentially.
  • The extent to which the risk to the PHI has been mitigated.

Run every gray-zone event through those four questions in writing. Not in a hallway conversation. In writing, with dates, names, and a conclusion. A fax sent to the wrong medical office where the recipient calls you, confirms they shredded it, and signs an attestation is a very different animal from a fax to an unknown number that was never returned. Same event on the surface. Different risk profile. Different outcome.

Common events and how to categorize them

Misdirected communication

Wrong-number faxes, emails to the wrong patient, portal messages to the wrong chart. These are the most common events in a busy practice. If the recipient is another covered entity or business associate and confirms destruction, your risk assessment usually lands on low probability. If the recipient is unknown or a member of the public, you're likely looking at a reportable breach.

Lost or stolen devices

If the device was encrypted and the encryption key was not compromised, HIPAA's safe harbor generally applies and notification is not required. If it wasn't encrypted, assume breach and start the clock. This is the single strongest argument for full-disk encryption on every laptop, workstation, and phone that touches PHI. It converts a potential breach into a documented incident.

Snooping by staff

An employee accessing a chart they had no business need to see is a breach in almost every case, even if they never told anyone what they saw. Access alone is the disclosure. This is where audit logs earn their keep. If your EMR can't tell you who opened which chart and when, you are working blind.

Phishing and credential compromise

If credentials were harvested but you can show through logs that no PHI was accessed during the compromise window, you may be able to document this as an incident rather than a breach. If you cannot show that, or if the attacker moved laterally into systems containing PHI, treat it as a breach until proven otherwise. Ransomware presumptively involves a breach unless you can demonstrate low probability of compromise, which is a high bar.

Verbal disclosures

Speaking a patient's name in a waiting room, discussing a case where you can be overheard, leaving a voicemail with too much detail. These are usually incidental disclosures permitted under the Privacy Rule if you have reasonable safeguards in place. Document that you have those safeguards. Train to them.

What you actually have to do, and when

If your risk assessment concludes breach, the clock starts from the date of discovery, not the date of the event. Discovery is when any workforce member other than the person who caused it knows, or reasonably should have known, about it.

  • Fewer than 500 individuals affected: Notify each affected individual without unreasonable delay and no later than 60 days from discovery. Log the breach and report it to HHS annually, within 60 days after the end of the calendar year.
  • 500 or more individuals affected: Notify individuals within 60 days, notify HHS within 60 days (not annually), and notify prominent media outlets serving the state or jurisdiction.
  • Business associate breaches: Your BA must notify you without unreasonable delay and no later than 60 days from their discovery. Your BAA should tighten that timeline. Sixty days is too long when your notification clock is also 60 days.

State laws often layer additional requirements on top: shorter timelines, attorney general notifications, credit monitoring offers. Check your state. If you operate across states, check all of them.

Building the muscle before you need it

The practices that handle these events well have three things in place before anything goes wrong.

First, a named privacy officer and a written incident response procedure that anyone at the front desk can follow for the first thirty minutes. Who to call, what to write down, what not to say to the patient yet. Panic is the enemy of good documentation.

Second, an incident log. Every event, not just the reportable ones. When OCR investigates, they often ask to see the log. A log with entries showing you catch, assess, and close small events is evidence of a working compliance program. An empty log means either nothing ever happens at your practice (unbelievable) or you aren't tracking (much worse).

Third, systems that make the assessment easier. EMR audit logs you can actually query. Encrypted devices by default. Message routing that ties communications to a specific chart so misdirection is harder. Role-based access so snooping shows up as an anomaly. If your infrastructure is fighting you during an investigation, you'll pay for it in hours and in exposure. If you're rethinking the platform underneath your clinic and want to see how modern infrastructure handles audit, access control, and messaging out of the box, talk to our team at Qintara.

Frequently Asked Questions

Is every unauthorized access to PHI automatically a breach?

No. It is presumptively a breach, which is different. You can rebut the presumption with a documented four-factor risk assessment showing low probability that PHI was compromised. The documentation is what makes the difference. A verbal "we decided it wasn't a breach" is not a defense.

What counts as "discovery" for the 60-day clock?

Discovery happens on the first day the event is known, or reasonably should have been known, to any workforce member other than the person who caused it. If a staff member notices a misdirected fax on Monday but doesn't report it until Friday, the clock likely started Monday. Train your team to escalate the same day.

Do we have to notify patients if the risk assessment concludes low probability?

No, but you still document the event, the assessment, and the conclusion, and keep that documentation for six years. Regulators care as much about your reasoning as about the outcome.

What if a business associate has a breach involving our patients?

The notification obligation to patients is yours, not theirs, unless your BAA delegates it. Your BA must tell you promptly so you can meet your timelines. Review your BAAs and make sure the notification window they owe you is meaningfully shorter than 60 days.

How long should we keep incident records?

HIPAA requires six years for documentation related to compliance activities. Some state laws require longer. Keep them somewhere you can actually retrieve them, not in a folder on a laptop that will be replaced in three years.