Safeguards, Incident Response, and Breach Notification
Safeguards and response
Privacy Rule administrative safeguards require reasonable policies, a designated official, training, and mitigation; the Security Rule adds administrative, physical, and technical safeguards for ePHI. When an incident occurs the sequence is contain, assess, document, notify, remediate, and learn.
Breach analysis
A breach is an impermissible acquisition, access, use, or disclosure that compromises security or privacy, subject to three exceptions: good-faith workforce access within scope, inadvertent same-entity disclosure, and disclosure the recipient could not reasonably retain. A breach is presumed unless a four-factor risk assessment shows low probability of compromise: nature and extent of the PHI, the unauthorized recipient, whether data was actually acquired or viewed, and the extent of mitigation. The burden of proof rests with the covered entity or business associate.
Deadlines
Individuals must be notified without unreasonable delay and no later than 60 days after discovery - discovery includes the date the entity would have known with reasonable diligence, and a business associate's discovery is imputed to the covered entity. Media notice applies for 500 or more residents of a state or jurisdiction; HHS notice is contemporaneous for 500 or more, otherwise annual. State laws may impose shorter deadlines and different content.
Traps
Treating day 60 as a target rather than an outer limit; claiming the encryption safe harbor without a secure, uncompromised key; failing to document the risk assessment.
Rule of thumb
Encrypted at rest with an uncompromised key: no notification. Unencrypted: run the four factors and write them down.