United States. Breach notification. Regulation

HIPAA Breach Rule / HITECHHIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) under the HITECH Act

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Requires covered entities to notify affected individuals, HHS and in larger cases the media following a breach of unsecured PHI. Business associates must notify the covered entity. The HITECH Act also made business associates directly liable and increased penalties.

Key themes

breach of unsecured PHI
presumption of breach
four-factor risk assessment
HHS reporting
business associate liability

Unique features

Breach is presumed unless a documented risk assessment shows low probability of compromise; breaches of 500+ are published on HHS's public portal.

SaaS relevance

SaaS business associates must notify their covered-entity customers without unreasonable delay and within 60 days of discovery.

§2Obligations

Extraterritorial: Limited
Breach notification: Individuals within 60 days; HHS within 60 days if 500+ (annual log if fewer); media if 500+ in a state; BA to CE within 60 days
Cross-border transfers: None
Maximum penalty: As HIPAA (tiered civil penalties)

§3Dates

Key dates

Adopted 24 August 2009
In force 23 September 2009
HITECH Act enacted 2009-02-17; interim final rule effective 2009-09-23; 'risk of harm' standard replaced by low-probability-of-compromise test in 2013 Omnibus Rule.

§4Text and authority

Text

Authoritative text ecfr.gov

Authority

HHS Office for Civil Rights (OCR)

§6Sources and verification

Sources consulted

hhs.gov

Verification

Medium confidence.