What Is a HIPAA Breach and What Should You Do if You Have One?

Your organization has had a HIPAA breach—now what do you do? Who do you notify, and what must you tell them? Are you subject to penalties?

We’ll explain that and much more below.

What Is a HIPAA Breach?

A HIPAA breach is “an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information.” This means if someone else accesses the patient data unlawfully– even accidentally–that’s a breach.

In terms of protections, healthcare data has some of the most restrictive and stringent security requirements in the U.S. There is a good reason for this: medical data is typically seen as completely private to the person involved in a way such that it should never be shared outside of the relationship between a patient and their doctor, healthcare provider or insurance payor.

With healthcare organizations primarily utilizing electronic methods to store and transmit patient records, HIPAA has set up several layers of regulations and controls around digital media, including networked transmission, database storage, and mobile computers like tablets and laptops. If medical data is compromised, accessed, or stolen in any way for any length of time in any of these locations, it will be termed a HIPAA breach that will call for specific responses and reporting.

In 2013, the HIPAA Omnibus Rule modified what “breach” means in legal terms and extended legal liability for those breaches to “business associates” (third-party contractors and companies working in the healthcare industry alongside providers).

Categories of HIPAA Breach Types

Protecting patient health information (PHI) requires constant vigilance, especially with evolving threats and human error. HIPAA violations can stem from a variety of causes—ranging from careless disposal to sophisticated cyberattacks. Below are some of the most frequent types of HIPAA breaches:

• Unauthorized Access or Disclosure: Occurs when PHI is accessed or disclosed by individuals without proper authorization or for reasons not permitted by the Privacy Rule. Example: An employee reviewing the medical records of a celebrity patient out of curiosity, without any treatment-related reason. This type of HIPAA breach highlights the importance of role-based access controls.
• Improper Disposal: Failure to securely dispose of physical or electronic PHI, leading to potential unauthorized access. Example: Discarding paper records containing patient names and diagnoses in regular trash bins instead of shredding them, allowing dumpster divers to potentially retrieve sensitive information.
• Hacking/IT Incident: Unauthorized access to systems containing electronic PHI (ePHI) due to external cyberattacks like malware, ransomware, or phishing. Example: A hospital’s network being compromised by ransomware, encrypting patient data and potentially exfiltrating it, leading to a significant HIPAA data breach.
• Loss or Theft of Devices: Misplacing or having stolen unencrypted devices (laptops, smartphones, USB drives) that store ePHI. Example: A doctor’s unencrypted laptop containing patient files being stolen from their car, exposing the ePHI stored on it.
• Third-Party (Business Associate) Lapses: Breaches occurring at a business associate organization that handles PHI on behalf of a covered entity. Example: A billing company contracted by a clinic experiencing a server breach, exposing the clinic’s patient financial and health information. The covered entity can still be held responsible for the BA’s non-compliance.

PHI Breach: Definition and Real‑World Examples

What specifically is a breach of PHI? A PHI breach is an impermissible use or disclosure under the HIPAA Privacy Rule that compromises the security or privacy of protected health information (PHI).

A breach of PHI is when this sensitive data is accessed, used, or disclosed in a manner not permitted by HIPAA, creating a significant risk of financial, reputational, or other harm to the individual.

Unlike general data breaches which might involve non-sensitive information, a HIPAA privacy breach specifically involves health-related data linked to an individual. For instance, accidentally emailing a patient’s diagnosis list to the wrong recipient, a nurse discussing a patient’s condition in a public cafeteria where it’s overheard, or a cyberattack exposing thousands of patient records containing names, Social Security numbers, and medical histories are all examples of PHI breaches.

The consequences of a PHI breach can be severe, leading to identity theft or fraud for patients, and significant fines, corrective action plans, and reputational damage for providers or covered entities involved in the hipaa data breach.

What Is the Difference Between a HIPAA Violation and a HIPAA Breach?

A HIPAA violation is an impermissible use or disclosure of protected health information (PHI) that is less severe than a breach. A HIPAA violation may or may not lead to a financial penalty or other sanctions, while a breach is a serious violation of HIPAA rules that can lead to sanctions, fines, and other corrective action. A HIPAA violation may involve the inappropriate use or disclosure of PHI within an organization, such as an employee disclosing a patient’s PHI or other related information without authorization.

A HIPAA breach, by contrast, typically involves the unauthorized disclosure of PHI to an unauthorized individual or entity, or the access by an unauthorized individual or entity to PHI. A breach can also include the loss of unsecured PHI, such as in the case of unauthorized physical or electronic access.

Is a Ransomware Attack Considered a Breach of HIPAA?

Yes, a ransomware attack is considered a breach of HIPAA and will trigger HIPAA’s notification requirements. HIPAA requires covered entities and their business associates to notify individuals and the Department of Health and Human Services (HHS) of any breaches of unsecured protected health information (PHI).

HIPAA Security Breach vs. Security Incident: Key Distinctions

Per the HIPAA Security Rule, a security incident is broadly defined as the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. This definition is quite wide-ranging and includes events like port scans, pings, and failed login attempts, which may not necessarily compromise PHI.

In contrast, a HIPAA breach, as defined earlier, specifically involves an impermissible use or disclosure of PHI that compromises its security or privacy.

The key difference lies in the outcome and the level of risk: many security incidents might occur daily without resulting in a breach because PHI is not compromised. However, every breach typically starts as a security incident.

Organizations must document all security incidents and their outcomes, regardless of whether they escalate to a breach. If a security incident leads to a determination that PHI was impermissibly used or disclosed (posing more than a low probability of compromise), it crosses the threshold into a reportable HIPAA breach, triggering specific notification requirements under the Breach Notification Rule. Simple incidents might only require internal documentation and remediation, whereas a confirmed breach necessitates external notifications and potentially more significant corrective actions.

Why Are There So Many More Data Breaches in the Healthcare Sector Than in Other Sectors?

There are several factors that contribute to the high number of data breaches in the healthcare sector. One of the main reasons is that healthcare organizations tend to store more sensitive personal data—such as medical records, insurance information, and payment information—than other industries. This data is highly lucrative on the dark web, as it can be used to commit identity theft and insurance fraud.

Second, this sensitive PHI is stored on multiple systems, not just computers and servers but on an overwhelming number of different medical devices and hand-held devices. These devices are engineered for functionality first and foremost; device security is seldom, if ever, a priority. These devices are also easy to misplace and even easier to exploit. Medical device security, in fact, is a serious risk management issue.

What Is the Privacy Rule for HIPAA?

More specifically, HIPAA breaches fall under the Privacy rule, which is one of the three major rules of HIPAA compliance:

1. The Privacy Rule. This rule establishes the basics for the privacy of electronic Personal Health Information (ePHI), including defining what ePHI actually is. This rule also defines to what extent patient information must remain private beyond security in terms of how it is transmitted and shared, and who is responsible for governing that privacy.
2. The Security Rule. The Security Rule defines methods and measures for securing ePHI through storage, transmission, and access. This includes definitions for aspects of data security like HIPAA encryption, risk management, and reporting.
3. The Breach Notification Rule. This aspect governs requirements for organizations when a security breach occurs. Includes guidelines for when, how, and how often to notify those affected by security breaches in healthcare systems.

The Privacy Rule is the cornerstone of the other rules because it literally defines what data is considered personal and protected. It sets the standards for protection, what is required by organizations handling healthcare ePHI, and when and how that ePHI can be disclosed, if ever.

Summary of the HIPAA Breach Notification Rule

The HIPAA Breach Notification Rule focuses on safeguarding patients’ PHI. This rule establishes the requirements and procedures covered entities and their business associates must follow in the event of unauthorized access to PHI. The Breach Notification Rule aims to ensure timely notification of affected individuals, the Department of Health and Human Services (HHS), and in some cases, the media. Ultimately, the HIPAA Breach Notification Rule is designed to mitigate the potential harm of a breach and prevent future breaches.

Per the Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay but no later than 60 days following the discovery of a breach. The notification should include a description of the breach, the types of PHI involved, the steps individuals should take to protect themselves, and the actions the organization is undertaking to mitigate the impact and prevent future occurrences. If the breach affects 500 or more individuals, the covered entity must notify the HHS simultaneously and sometimes alert the media. For breaches involving fewer than 500 individuals, the covered entity must maintain a log and submit it to the HHS annually.

Adherence to the HIPAA Breach Notification Rule ensures transparency, timely response, and remediation efforts, helping to restore trust between patients and healthcare providers while maintaining the integrity and confidentiality of sensitive health information.

Required Elements of a Breach Notification Letter

When a HIPAA breach occurs, covered entities and business associates are legally required to notify affected individuals. These notifications must follow strict content requirements set by the U.S. Department of Health and Human Services (HHS). Below are the essential elements that must be included to ensure transparency, accountability, and clear guidance for those impacted:

• A Brief Description of the Breach: Include the date of the breach and the date of its discovery.
• Types of PHI Involved: Specify the categories of unsecured PHI that were accessed or disclosed (e.g., name, address, date of birth, Social Security number, medical record number, diagnosis, treatment information, health insurance information).
• Steps Individuals Should Take: Recommend actions individuals can take to protect themselves from potential harm resulting from the breach (e.g., monitoring account statements, reviewing credit reports, placing fraud alerts).
• Organization’s Mitigation Efforts: Briefly describe what the covered entity or business associate is doing to investigate the breach, mitigate losses, and protect against further breaches (e.g., implementing enhanced security measures, providing identity theft protection services if applicable).
• Contact Information: Provide contact procedures for individuals to ask questions or learn additional information, including a toll-free telephone number, email address, website, or postal address.
• Clarity Requirement: HHS mandates that all breach notifications must be written in plain language to ensure affected individuals can easily understand the information provided.

Penalties for Non‑Compliance With the Breach Notification Rule

Failure to comply with the HIPAA Breach Notification Rule can result in significant penalties imposed by the HHS Office for Civil Rights (OCR).

These penalties are tiered based on the level of culpability associated with the HIPAA violation:

• Tier 1 applies to violations where the entity did not know and could not reasonably have known about the breach ($137 to $34,464 per violation, up to $68,928 annually).
• Tier 2 covers violations due to reasonable cause, not willful neglect ($1,379 to $68,928 per violation, up to $206,781 annually).
• Tier 3 involves willful neglect corrected within 30 days ($13,785 to $68,928 per violation, up to $1,378,550 annually).
• Tier 4 represents willful neglect not corrected within 30 days ($68,928 per violation minimum, up to $2,067,813 annually).

These amounts are adjusted periodically for inflation. Aggravating factors, such as the duration of non-compliance, the number of individuals affected, the nature of the PHI involved, and a history of prior violations, can lead to higher penalties within a tier. Repeated offenses or clear evidence of willful neglect often result in the most severe fines and mandatory corrective action plans.

State Breach Notification Laws vs. HIPAA Requirements

While HIPAA establishes a federal baseline for breach notification, organizations must also be aware that many states have their own data breach notification laws that can be stricter or have different requirements.

These state laws may impose shorter notification deadlines than HIPAA’s 60-day outer limit, require notification to state Attorneys General or other state agencies in addition to HHS and affected individuals, or define “personal information” more broadly than HIPAA defines PHI.

For example, California’s breach notification law (part of the California Consumer Privacy Act – CCPA/CPRA) has specific requirements regarding the content and timing of notifications and applies to a broader range of personal information.

Similarly, Massachusetts has stringent data security regulations (201 CMR 17.00) that include prompt notification requirements. Covered entities and business associates operating in multiple states must navigate this complex landscape and ensure compliance with both HIPAA and all applicable state laws, typically adhering to the strictest applicable requirement to ensure full compliance.

Harmonizing these obligations often requires careful legal review and a robust incident response plan.

Timeline for Notifying Individuals of PHI Breaches

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals following the discovery of a breach of unsecured PHI without unreasonable delay and in no case later than 60 calendar days after the discovery of the HIPAA breach.

Discovery occurs when the entity knows, or reasonably should have known, about the breach. While 60 days is the absolute outer limit, HHS guidance emphasizes that notification should often occur much sooner.

Best practice involves a prompt internal process: immediately containing the breach upon discovery, conducting a swift risk assessment (typically within days, not weeks) to determine if notification is required (i.e., assessing the probability that PHI has been compromised), drafting the notification letter ensuring all required elements are included, and dispatching the notices via first-class mail (or email if the individual has consented).

Delaying notification up to the 60-day mark without a valid reason (like needing time for law enforcement investigation or compiling accurate contact information) is considered unreasonable and could itself be a violation.

Effective Dates of the Breach Notice Requirements

The core requirements for notifying individuals and HHS of a HIPAA breach were established by the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was enacted as part of the American Recovery and Reinvestment Act of 2009.

The HITECH Act introduced the formal HIPAA Breach Notification Rule. An interim final rule detailing these requirements was issued on August 24, 2009, and became effective on September 23, 2009. However, the rule was significantly updated by the HIPAA Omnibus Final Rule, published on January 25, 2013.

This Omnibus Rule finalized the HITECH modifications, notably strengthening the definition of a breach (adopting a presumption that any impermissible use/disclosure is a breach unless a low probability of compromise is demonstrated) and extending direct liability for compliance, including breach notification, to business associates.

The compliance date for most provisions of the Omnibus Rule, including the updated breach notification requirements, was September 23, 2013. Organizations needed to be fully compliant with these finalized requirements by that date.

When and How Should You Report a HIPAA Breach?

The HIPAA Breach Notification Rule defines a breach as an impermissible disclosure of ePHI. Any unauthorized or impermissible disclosure is considered a breach unless the organization affected can prove that unlawful access did not compromise confidential health data.

According to the rule, the affected organization must notify affected individuals of the data that has been compromised in writing or by email, and they must do it within 60 days of discovering the unlawful access. The letter should include the following information:

1. A description of the HIPAA breach.
2. The kinds of data being compromised.
3. Mitigation efforts that are taken by the organization.
4. The steps a patient should take to protect themselves or their data.
5. Optional information for credit protection, including resources to check and monitor their credit or place a fraud notification on their credit report.

If the organization cannot reasonably contact 10 or more people affected (due to out-of-date information) then it must also place a notice on their website for at least 90 days after the discovery of the breach. If there are 10 or fewer individuals, then the affected organization can use telephone calls or other written notices.

If the HIPAA breach impacts more than 500 individuals, then the organization must further provide information to prominent media outlets within the state of jurisdiction.

Finally, all affected organizations must inform the Secretary of Health in writing or through an online form.

In most cases, a breach must be reported. The exception to this rule is if the affected organization can show that there is a low probability that hackers accessed or stored ePHI by performing a risk assessment based on the following factors:

1. The types of ePHI affected.
2. The type of breach and the credentials used to access it.
3. The actual viewing (or not) of the data.
4. The extent where the risk against the use or theft of the ePHI has been mitigated.

That is, if a healthcare organization can show that a data breach didn’t expose data due to lack of credentials or some combination of factors that would make it impossible to be stolen or viewed, then the organization can forego notifying affected parties. This can look like a few mistakes:

1. An employee unintentionally accesses patient information accidentally as part of their job.
2. Two authorized people expose data to each other in the same or different organization.
3. The data compromised will, most likely, not be saved outside of secure systems.

What Happens After You Have Made a HIPAA Data Breach Notification to HHS?

Once a covered entity or a business associate has notified HHS of a data breach, several steps are taken to ensure that the breach is adequately addressed and that all necessary actions are implemented to prevent future occurrences. It is crucial for organizations to understand the process following a breach notification. The process includes preparing for potential investigations, remediation efforts, and penalties.

Upon receiving the breach notification, the HHS Office of Civil Rights (OCR) reviews the submitted information and may initiate an investigation to assess the circumstances surrounding the breach. The primary goal of the investigation is to determine whether there have been violations of the HIPAA Privacy, Security, or Breach Notification Rules. The OCR may request additional information or documentation from the covered entity or business associate and conduct site visits if necessary.

If the OCR identifies a HIPAA violation, the covered entity or business associate may face penalties, including financial fines, corrective action plans, and in some cases, a resolution agreement. The severity of the penalties depends on factors such as the extent of the breach, the level of negligence, and the organization’s history of compliance. The organization must cooperate fully with the OCR during the investigation and demonstrate efforts to remediate any identified issues.

During this time, the organization should also focus on strengthening its privacy and security practices, addressing vulnerabilities, and implementing corrective measures to prevent future breaches. By improving their HIPAA compliance, organizations can minimize potential penalties and better protect their patients’ health information.

Where Should You Report HIPAA Violations if You Are the Victim of a Data Breach?

Suppose you suspect you are a victim of a data breach involving your PHI and believe there has been a HIPAA violation. In that case, taking action and reporting the incident is essential. Reporting HIPAA violations helps ensure that the responsible parties are held accountable and that measures are taken to prevent similar breaches in the future.

The first step in reporting a HIPAA violation is to contact the covered entity, such as the healthcare provider or insurance company, responsible for maintaining your PHI. Inform them about the suspected breach and request an investigation into the matter. They are obligated to investigate, take corrective action, and notify affected individuals per the HIPAA Breach Notification Rule.

If you are dissatisfied with the covered entity’s response or believe they are not taking appropriate action, you can file a complaint with the HHS OCR.

As a reminder, the OCR is responsible for enforcing HIPAA regulations and investigating potential violations. You can submit a complaint online through the OCR’s website or by mail, fax, or email. It is essential to file the complaint within 180 days of when you first became aware of the potential violation, although the OCR may grant an extension under certain circumstances.

By reporting HIPAA violations, you play a crucial role in maintaining the privacy and security of your PHI and that of other patients, ensuring healthcare organizations uphold their responsibilities under HIPAA.

What if You Accidentally Violate HIPAA?

Not all HIPAA security violations are due to willful neglect. With such complex requirements and potential attack vectors, it can be understandable if an organization accidentally misses HIPAA compliance requirements. Doctors, for example, may send messages to one another that contains ePHI to expedite emergency treatment. In these cases, secure systems can mitigate larger consequences of disclosure without compromising the ability of a healthcare worker to act quickly and decisively.

Predominantly, there are several ways to accidentally violate HIPAA:

1. Intentional avoidance: As when a doctor shares information outside compliant channels to expedite emergency treatment.
2. Accidental exposure: Disclosure made without intention to do so.
3. Intentional disclosure: Either due to theft or hacking. Most often occurs due to an individual within the organization.

If you or your healthcare organization accidentally violate HIPAA, you should report it within 60 days of discovery of the violation. The earlier you send the notification the better, to avoid the fallout from lost data.

Following the accidental violation, complete any requirements for a HIPAA violation that your organization must comply with (reporting, notifications, etc.). It may be the case that, since data access was unintentional, in which case the actual compliance requirements might be relatively small.

If the accidental violation was any of the potential examples above (accessed in good faith internally, between two authorized people, or there is evidence the data will not be retained outside of the organization) then you may not have to worry too much about the violation.

Designating a violation as accidental has real meaning when it comes to fines. Penalties for violations can range from $100 to $50,000 per incident (per record compromised) depending on the kind of data, the source of the vulnerability, and whether or not it was accidental or due to willful negligence.

Examples of Unintentional HIPAA Violations

Even without malicious intent, healthcare workers and support staff can inadvertently violate HIPAA regulations during routine activities. These unintentional breaches often stem from everyday oversights, but they still pose serious risks to patient privacy and can result in regulatory penalties. Below are some common examples of accidental HIPAA violations—along with practical tips to prevent them in your organization:

• Misdirected Communications: Accidentally sending an email or fax containing PHI to the wrong recipient due to a typo in the address or number. Violation: Unauthorized disclosure of PHI. Prevention: Double-check recipient information, use secure email/fax solutions with confirmation features, implement data loss prevention (DLP) tools.
• Leaving PHI Visible: Leaving patient charts open on a desk, a computer screen unlocked displaying ePHI in an accessible area, or posting PHI on shared whiteboards visible to unauthorized individuals. Violation: Failure to safeguard PHI. Prevention: Implement clean desk policies, use privacy screens, enable automatic screen locks, ensure physical safeguards restrict visibility.
• Overheard Conversations: Discussing specific patient cases or PHI in public areas like hallways, elevators, or cafeterias where conversations can be easily overheard by visitors or other staff not involved in the patient’s care. Violation: Impermissible disclosure of PHI. Prevention: Conduct sensitive conversations in private areas, use lowered voices, avoid using patient names or identifiable details in public settings.
• Improper Disposal of PHI: Tossing papers with patient information into regular trash bins instead of designated shredding bins. Violation: Failure to implement proper disposal policies. Prevention: Train staff on correct disposal procedures, provide clearly marked shredding bins, ensure secure disposal of electronic media.
• Accessing PHI Without Need-to-Know: An employee looking up the records of a coworker, family member, or friend out of curiosity, even if they technically have system access. Violation: Accessing PHI beyond the minimum necessary for job functions. Prevention: Implement strict role-based access controls, conduct regular access audits, train staff on appropriate access policies and potential sanctions. These are clear examples of unintentional hipaa violations that still constitute a HIPAA violation.

Accidental Breach vs. Incidental Breach: Key Differences

HIPAA distinguishes between an incidental disclosure, which is generally permissible under specific conditions, and an accidental breach, which represents a potential HIPAA violation requiring further action.

An incidental disclosure is a secondary use or disclosure of PHI that cannot reasonably be prevented, occurs as a by-product of an otherwise permitted use or disclosure, and is limited in nature, provided reasonable safeguards and the minimum necessary standard are applied.

For example, a visitor might glimpse a patient’s name on a sign-in sheet if the clinic has implemented reasonable safeguards like keeping the sheet partially covered. This is generally not considered a violation.

Conversely, an accidental breach involves an unintentional, impermissible use or disclosure of PHI that compromises its security or privacy, such as accidentally emailing a patient’s full medical record to the wrong person.

Unlike incidental disclosures, accidental breaches must undergo a formal risk assessment to determine the probability of compromise. If the risk is more than low, it triggers the HIPAA breach notification requirements.

For instance, if two doctors discuss a patient quietly in a semi-private room (an incidental disclosure might occur if someone briefly overhears), versus shouting the patient’s condition across a busy waiting room (likely an accidental, reportable breach). The key is whether reasonable safeguards were in place and if the disclosure was truly unavoidable and limited during a permissible activity.

Why Staff Must Be Trained on Reporting HIPAA Breaches

Proper staff training on reporting HIPAA breaches is critical to maintaining the privacy and security of patients’ PHI. There are several reasons why.

First and foremost, staff training helps create a culture of compliance and awareness within the organization. By educating employees on the importance of HIPAA regulations and their role in safeguarding PHI and patient privacy, they become more vigilant and proactive in identifying and addressing potential risks. This heightened awareness can lead to the prevention of breaches and a more robust security posture overall.

Second, a well-trained staff can quickly detect and report breaches, ensuring that the organization can immediately mitigate the impact. Prompt reporting and response are crucial for limiting the potential harm to affected individuals and minimizing the organization’s exposure to fines and penalties associated with the HIPAA Breach Notification Rule.

Additionally, staff training on reporting HIPAA breaches is crucial for maintaining organizational transparency and accountability. Employees should feel confident reporting breaches or potential violations without fear of retaliation, creating an environment where privacy and security are prioritized and actively supported.

Finally, providing staff with the necessary knowledge and tools to report HIPAA breaches ensures that the organization complies with HIPAA. Regular training updates and refreshers help staff stay informed about new threats and evolving best practices, further reinforcing the organization’s commitment to maintaining the privacy and security of PHI.

How Can You Mitigate the Impact of a HIPAA Breach?

If a breach happens, you don’t need to panic, but you do need to take steps to mitigate the damage from the breach as soon as possible.

1. Perform a risk analysis. This analysis outlines the timeline of the breach, the cause, and the potential impact of the breach based on the information gathered. This is where you can determine where violations may have occurred and trace accountability through your organization. You’ll also want to determine the kind of data stolen and who has been affected.
2. Handle any notification requirements your organization may have based on the HIPAA notification rule. You’ll also want to contact law enforcement plus any third-party security firms you have relationships with.
3. Implement specific security measures to counteract the breach. If the breach was associated with a blatant disregard for compliance, then correcting the problem should be easy, if costly in terms of time, money, and reputation.

The best mitigation, overall, is predictive prevention. Having compliant and secure solutions for data storage, transmission, and HIPAA-compliant email while working with an expert firm and/or platform provider can help head off potential problems before they become major breaches.

Good‑Faith Compliance and Its Effect on Penalties

Demonstrating a “good faith attempt” at HIPAA compliance prior to and immediately following a HIPAA data breach can significantly influence the outcome of an investigation by the HHS Office for Civil Rights (OCR) and potentially mitigate penalties.

While good faith doesn’t excuse a breach, evidence of proactive measures—such as conducting regular and thorough risk analyses, implementing documented privacy and security policies and procedures, providing ongoing workforce training, and having an incident response plan—signals to OCR that the organization took its compliance obligations seriously.

When a breach does occur, a swift, well-documented response, including timely internal investigation, prompt mitigation efforts, and adherence to the HIPAA Breach Notification Rule, further demonstrates good faith.

OCR considers these factors when determining culpability and calculating fines. For instance, if an organization can show it had reasonable safeguards in place but fell victim to a sophisticated, previously unknown cyberattack, the resulting penalties might fall into lower tiers (reasonable cause vs. willful neglect).

Conversely, a lack of documented risk assessments or ignored known vulnerabilities often leads to findings of willful neglect and much higher fines. Several resolution agreements published by OCR illustrate cases where entities received lower penalties due to evidence of prior compliance efforts and robust post-breach responses, even when a significant breach occurred.

HIPAA Breach Response Checklist

When a HIPAA breach occurs, a swift, structured response is essential to minimize harm, ensure compliance, and prevent future incidents. The steps below outline a best-practice approach to handling a breach,from immediate containment through regulatory reporting and long-term remediation. Following this process helps demonstrate due diligence and protects both patients and the organization.

• Immediate Containment: Identify and stop the source of the breach. Secure affected systems, revoke compromised access, and prevent further unauthorized disclosure of PHI.
• Preliminary Assessment & Assemble Response Team: Quickly evaluate the nature and scope of the incident. Activate the designated incident response team (including privacy/security officers, IT, legal counsel).
• Forensic Investigation (if applicable): Determine the cause, timeline, extent of data accessed/acquired, and systems affected. Preserve evidence securely.
• HIPAA Risk Assessment: Conduct and document the four-factor risk assessment (type/extent of PHI, unauthorized person, PHI actually acquired/viewed, mitigation extent) to determine if there is a low probability of compromise. If not, it’s a reportable HIPAA breach.
• Notification Preparation: If deemed a reportable breach, identify affected individuals. Draft notification letters containing all elements required by the HIPAA Breach Notification Rule. Prepare for media notice if >500 individuals affected.
• Regulatory Reporting & Individual Notification: Notify affected individuals without unreasonable delay (max 60 days). Notify HHS OCR (concurrently if >500 affected, annually if fewer). Notify media if >500 affected. Notify relevant state agencies if required by state law.
• Mitigation & Remediation: Implement measures to mitigate harm to individuals (e.g., credit monitoring). Address vulnerabilities that led to the breach to prevent recurrence (e.g., update security, enhance training).
• Post-Incident Review & Documentation: Analyze the response effectiveness. Update policies, procedures, and risk analyses based on lessons learned. Maintain thorough documentation of the incident and response efforts for at least six years.

Data Breaches by Business Associates

Business associates are third-party organizations that handle, store, or process protected health information on behalf of covered entities, such as healthcare providers and insurance companies. Like covered entities, business associates must comply with privacy and security regulations to safeguard the PHI they manage. Unfortunately, data breaches can still occur, and understanding the common causes and consequences of these breaches is essential for both business associates and covered entities.

Data breaches involving business associates can result from various factors, such as human error, inadequate security measures, or targeted cyberattacks. These breaches can lead to the unauthorized disclosure, alteration, or destruction of PHI, putting patients at risk of identity theft, financial fraud, and loss of privacy. Common causes include phishing campaigns, weak password policies, unauthorized access, improper disposal of PHI, and lost or stolen devices containing sensitive information.

When a data breach involving a business associate occurs, the business associate and the covered entity must take immediate action to assess the scope of the breach, identify the affected individuals, and mitigate potential harm. In line with the HIPAA Breach Notification Rule, they must notify affected individuals, the HHS OCR, and in some cases, the media about the breach. Failure to do so can result in significant financial penalties, damage to reputation, and loss of trust among patients and partners.

Business associates should implement robust security policies to prevent data breaches, conduct regular risk assessments, provide team member training, and maintain incident response plans. By proactively addressing potential vulnerabilities and complying with HIPAA regulations, business associates can better protect the PHI they handle and minimize the risk of costly breaches.

Stay HIPAA Compliant and Avoid Breaches With Kiteworks

Kiteworks provides covered entities and their business associates a secure and compliant file sharing and file transfer solution for email, file sharing, MFT, and SFTP. With granular access controls and best-in-class encryption, Kiteworks ensures that only authorized users have access to protected health information, and this and other sensitive information stays private in transit and at rest. Kiteworks seamlessly integrates with a range of enterprise applications and security infrastructure, making it an invaluable asset for organizations that must govern, protect, and control their sensitive content in compliance with HIPAA and other data privacy regulations and standards.

Additionally, Kiteworks provides unparalleled visibility into all file activity—namely who sent what file to whom, when, and how—empowering businesses to maintain full control over their documents and enhance their overall security posture. With Kiteworks, healthcare organizations can confidently navigate a digital landscape fraught with risk and threats, knowing their PHI and other sensitive content is sent, shared, received, and stored securely.

To learn how Kiteworks can help you achieve HIPAA compliance, schedule a custom demo today.

Additional Resources

• Blog Post What Are HIPAA Compliance Requirements? [Complete Checklist]
• Blog Post What Is the HIPAA Minimum Necessary Rule?
• Blog Post Top HIPAA-compliant Forms
• Blog Post HIPAA Encryption: Requirements, Best Practices & Software
• Blog Post Send HIPAA-compliant Email