thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

HIPAA Breach Notification Rule

HIPAA rule requiring notification of individuals, HHS, and sometimes media after a breach of unsecured PHI.

Definition

Individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals must be reported to HHS within 60 days and to prominent media in the affected state or jurisdiction; smaller breaches are reported to HHS within 60 days after the end of the calendar year. A breach is presumed unless a four-factor risk assessment shows low probability of compromise.

Example

A stolen unencrypted laptop with 2,000 patient records requires notice to patients, HHS, and media.

Exam tip

Encryption meeting HHS guidance makes PHI 'secured,' avoiding breach notification.

Related terms