However, according to HHS, breach notifications can also be issued without performing the risk assessment to ensure that the PHI was compromised. Was the PHI actually acquired or viewed by any unauthorized person or entity.Was the PHI disclosed to or used by an unauthorized person or entity.The extent and nature of the PHI involved.

However, this belief has to be substantiated with a risk assessment covering the following: The notification by the covered entity or business associate can be issued if they believe that the PHI was compromised. Any sensitive information that has not been protected through the use of password, multi-factor authentication or other such means may be deemed as unsecured PHI. However, it is important to remember that the HIPAA rule applies only to unsecured PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in guidance. It is precisely for situations such as this that the HIPAA data breach notification rule has been formulated.Īs per the HIPAA breach notification rule, covered entities and their business associates are required to inform / notify the patients, the HHS and potentially the media, in case any unsecured protected health information (PHI) is compromised at their end. We saw the reality of this fear when personally identifiable information of about 80 million individuals was potentially exposed by the data breach at Anthem. The risk of personal identifiable information falling into the wrong hands or even finding its way into the public domain is a fear that we constantly live with, in this age of digital records and internet.

Hipaa breach notification rule