What Counts As A Healthcare Breach Under Hipaa?

A healthcare breach under HIPAA is any impermissible use or disclosure of protected health information that compromises its security or privacy — whether it happened by accident or on purpose. It does not require proof that anyone actually saw, stole, or misused the information. The legal trigger is unauthorized access or exposure, not demonstrated harm. That distinction is why so many breaches reported each year involve a lost laptop, a misdirected fax, or a mailing error rather than a hacker.

HIPAA stands for the Health Insurance Portability and Accountability Act, a federal law passed in 1996. Its privacy and security rules govern how covered entities and their business associates handle protected health information, commonly called PHI. The rules apply to a specific set of organizations and to a specific category of data, and both matter when deciding whether something counts as a breach.

What Is Protected Health Information Under HIPAA?

Protected health information is any information that relates to a person’s past, present, or future physical or mental health, the care they received, or payment for that care — and that identifies them or could reasonably be used to identify them. The definition is deliberately broad.

The key concept is the identifier. Health information on its own is not automatically PHI. It becomes PHI when it is linked to something that points to a specific person. Identifiers include names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses, medical record numbers, and full-face photographs, among others.

This is why a de-identified dataset is treated differently from a spreadsheet with names attached. When a record is genuinely stripped of identifying details according to the standard the rule sets out, it generally falls outside the definition of PHI. Remove the identifier, and much of the privacy obligation falls away with it.

PHI can exist in many forms:

• Written and printed records, including paper charts
• Electronic records stored in a system or on a device
• Spoken information exchanged in conversation
• Images, scans, and recordings

Any of these can be the subject of a breach if the information is handled in a way the rules do not allow.

What Counts As A Healthcare Breach Under HIPAA?

A breach occurs when PHI is accessed, used, or disclosed in a way that violates the privacy rule, and the incident is not covered by an exception. The rule defines a breach as the acquisition, access, use, or disclosure of PHI in a manner not permitted, that compromises the security or privacy of the information.

The word “compromises” is doing a lot of work here. It does not mean the information was proven to cause harm. It means the incident created a meaningful risk that the information could be misused. A record left visible on a screen in a public area, a file emailed to the wrong patient, or a stolen unencrypted phone can all qualify.

Some events are not considered breaches because of specific exceptions written into the rule:

• Unintentional access by a workforce member acting in good faith, within the scope of their job, that does not result in further unauthorized use.
• Inadvertent disclosure between two people who are both authorized to access the information, where the information is not further shared.
• A disclosure where the receiving party could not reasonably have retained the information.

These exceptions are narrow. They apply to genuine accidents within an authorized setting, not to someone who was never supposed to see the information in the first place.

Does a Breach Require Proof That Someone Was Harmed?

No. This is one of the most common misunderstandings about HIPAA. A breach does not require evidence that anyone actually viewed the information, that it was misused, or that a patient suffered any harm.

What matters is whether the incident created a risk of harm — not whether harm occurred. The standard is about the potential for compromise, not a demonstrated outcome. A lost unencrypted laptop containing patient records is a breach even if the laptop is later found and no one ever opened the files.

When deciding whether a specific incident qualifies, organizations are expected to assess four factors:

• The nature and extent of the information involved, including identifiers and how likely the data is to be misused.
• The person who accessed or received the information, and whether they have an obligation to protect it.
• Whether the information was actually acquired or viewed.
• The extent to which the risk has been reduced, such as if the data was encrypted.

Encryption matters a great deal here. If PHI is properly encrypted and the encryption key is not compromised, the information is generally not considered “unsecured,” and the incident may not need to be reported. This is one reason encryption is treated as a core safeguard rather than an optional extra.

Who Has to Follow HIPAA Breach Rules?

HIPAA does not apply to everyone who handles health information. It applies to two main groups: covered entities and business associates.

Covered entities include health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain standard transactions. A hospital, a clinic, a pharmacy, and a health insurer are typical examples.

Business associates are outside organizations that perform work for a covered entity and need access to PHI to do it. A billing company, a cloud storage vendor, or an outside transcription service can all be business associates. They are directly bound by the security and breach rules, not just through their contract.

If an organization is not a covered entity or a business associate, HIPAA generally does not govern it. That does not mean no rules apply. Other laws, state regulations, and industry standards may still cover the same information. A fitness app or a general consumer health tracker, for example, often falls outside HIPAA entirely — a point that surprises many people who assume any health data is protected.

How Do Organizations Report a Breach?

Once an organization determines that a breach has occurred, notification requirements kick in. The general rule is that affected individuals must be notified without unreasonable delay and no later than 60 days after the breach is discovered.

Reporting also depends on scale:

• If a breach affects fewer than 500 people, the organization generally notifies those individuals and reports to the federal government on an annual basis.
• If a breach affects 500 or more people, the organization must notify the government at the same time it notifies individuals, and it must also notify the media in the affected area.

The notices must describe what happened, the types of information involved, what steps affected people can take to protect themselves, and what the organization is doing in response. These requirements are established in the breach notification rule, and the specific thresholds are written directly into the regulation.

One detail worth knowing: the clock starts when the breach is discovered, not when it is fully investigated. An organization cannot delay notification indefinitely while it studies the incident.

What Are the Most Common Types of Healthcare Breaches?

Hacking and IT incidents now account for a large share of reported breaches, but they are far from the only cause. Many breaches are low-tech and entirely preventable.

Common categories include:

• Hacking and ransomware. Unauthorized access to systems, often through stolen credentials or software vulnerabilities.
• Lost or stolen devices. Unencrypted laptops, phones, and drives remain a recurring problem.
• Misdirected communication. Emails, faxes, and mail sent to the wrong recipient.
• Insider incidents. Employees accessing records they have no work reason to view.
• Improper disposal. Paper records or devices thrown away without being secured.

The insider category deserves attention because it is easy to overlook. A staff member who looks up a celebrity’s chart, a neighbor’s record, or an ex-partner’s file has committed a breach even though no outside attacker was involved. Curiosity is not a permitted reason to access PHI.

This is where a non-obvious point matters: the size of a breach is not what makes it a breach. A single improperly accessed record can be a reportable breach, and a large incident that turns out to be fully encrypted may not be. The trigger is the nature of the incident, not the number of people affected.

What Happens When a Breach Occurs?

Consequences can include federal penalties, corrective action plans, and required changes to how an organization handles information. Penalty amounts vary based on factors such as the level of negligence, whether the problem was corrected, and whether it was a repeat offense. The tiers and ranges are set in federal regulation, and the specific dollar amounts are adjusted over time.

Beyond penalties, a breach usually triggers internal review. Organizations typically investigate how the incident happened, whether safeguards failed, and what needs to change. The goal is not just to respond to one event but to prevent the next one.

For individuals, the practical impact depends on what was exposed. A breach involving financial details or Social Security numbers may require credit monitoring. A breach involving only clinical information may carry different risks. The notification letter is meant to explain which applies.

It is worth being clear about what HIPAA does and does not do. It sets a national floor for privacy and security. It does not give individuals a private right to sue under HIPAA itself, though other legal avenues may exist depending on the circumstances and the state. Understanding that boundary helps people know where to direct a concern.