HIPAA Privacy, Security, and Breach Notification
Privacy Rule
Covers protected health information in any form. Treatment, payment, and healthcare operations (TPO) are permitted uses; other disclosures require a valid authorization unless a specific regulatory exception applies. The minimum necessary standard governs most uses and disclosures, but not disclosures to a treating provider. Individual rights include access (generally within 30 days, one 30-day extension), amendment, accounting of disclosures for six years excluding TPO, confidential communications, and a paper notice of privacy practices. A covered entity must agree to restrict disclosure to a health plan for services paid in full out of pocket.
Security Rule
Applies only to electronic PHI. Requires administrative, physical, and technical safeguards. Risk analysis is a required implementation specification, not addressable. "Addressable" means assess, then either implement or document why it is not reasonable and implement an equivalent alternative.
Breach Notification
A breach is presumed unless a four-factor risk assessment shows low probability of compromise: nature and extent of the PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and the extent of mitigation. Notify affected individuals without unreasonable delay and no later than 60 days after discovery; notify HHS concurrently for breaches affecting 500 or more (annually for smaller breaches); notify media for 500 or more residents of a state or jurisdiction. Business associates notify covered entities.
Traps
Encryption to a valid standard supports a safe harbor. "We did not know" is not a defense - discovery starts the clock. A lost unencrypted device is presumed a breach absent a documented risk assessment.
Worked Example
A stolen unencrypted laptop containing 800 patient records triggers individual notice within 60 days, immediate HHS notice, and media notice in the affected market.