HIPAA breach risk assessment
The four-factor assessment that decides whether an incident involving PHI is a reportable breach — what each factor means, the exceptions, and how to document it.
On this page
HIPAA breach risk assessment at a glance
A HIPAA breach risk assessment is the documented four-factor analysis a covered entity or business associate uses to decide whether an impermissible use or disclosure of PHI is a reportable breach. Unless it shows a low probability that the PHI has been compromised, the incident is presumed to be a breach and notification is required. The four factors are the nature of the PHI, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated (45 CFR 164.402).
| Rule | 45 CFR 164.402 — definition of breach |
|---|---|
| Default | Presumed a breach unless the assessment shows low probability of compromise |
| Four factors | Nature of PHI · recipient · acquired or viewed · mitigation |
| Not needed if | The PHI was secured (properly encrypted) or an exception applies |
| Keep | The written assessment — you carry the burden of proof (164.414) |
HIPAA does not ask “was harm likely?” It asks whether there is a low probability that the PHI has been compromised. An impermissible use or disclosure is presumed to be a breach unless your documented assessment shows that low probability (45 CFR 164.402). If you are dealing with an incident now, start with You had a data breach.
First: is it unsecured PHI, and does an exception apply?
Notification duties apply to unsecured PHI. If the data was encrypted to HHS’s standard and the key wasn’t compromised, it is not unsecured — see encryption. The definition also excludes three situations: an unintentional, good-faith access by a workforce member acting within their authority, with no further impermissible use; an inadvertent disclosure between people authorized to access PHI at the same organization or arrangement; and a disclosure where you have a good-faith belief the recipient could not have retained the information.
The four factors
- The nature and extent of the PHI — types of identifiers, sensitivity (diagnoses, mental health, financial data), and how likely re-identification is.
- The unauthorized person who used it or received it — another covered entity bound by HIPAA is different from a stranger.
- Whether the PHI was actually acquired or viewed — for example, a forensic review showing a lost laptop was never accessed.
- The extent to which the risk has been mitigated — such as written assurance from the recipient that the information was deleted and not used.
Weigh all four together. One reassuring factor doesn’t settle it.
Documentation
You carry the burden of proof that notifications were made, or that an incident was not a breach (45 CFR 164.414). Write down the facts, dates, each factor and your conclusion, and keep it for six years. If the assessment shows a breach, the notification clock runs from the date of discovery — see breach notification.
Next steps
- HIPAA for therapists and psychologists in private practice →Scenario
- HIPAA for dental practices →Scenario
- Notifying patients of a breach →Requirement
- Encryption of ePHI →Requirement
- Business associate agreements (BAAs) →Requirement
- HIPAA documentation retention →Requirement
Frequently asked questions
Is a misdirected email a HIPAA breach?
Presumed so unless your four-factor assessment shows a low probability of compromise — for example, it went to another covered entity's staff who confirmed deletion and the content was limited.
Can we skip the assessment and just notify?
Yes. You may choose to notify without an assessment; the assessment is how you show that notification was not required.
Who does the assessment when a vendor causes the incident?
The business associate must notify the covered entity. The covered entity generally keeps the regulatory duty to notify individuals and HHS, although the BAA may assign who performs those tasks.