HIPAA Security Incident or Data Breach?

Updated April 16, 2025

Today, we’re tackling a critical distinction that often confuses the healthcare sector: What is the difference between a security incident and a breach under HIPAA? Understanding these terms is essential for anyone in the healthcare industry, particularly those handling PHI (Protected Health Information). So, let’s dive in!

Breaking Down the Basics

First up, let’s define our terms.

Security Incident: This is a broad term used in HIPAA to describe an attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. Think of it as any activity that could threaten PHI’s security.
Breach: Under HIPAA, a breach is defined more precisely. It’s an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the PHI. Essentially, a breach is a type of security incident that results in the confirmed exposure of PHI in a way not allowed by the Privacy Rule.

The Nuances of a Security Incident

A security incident is like your healthcare data’s first line of defense. It’s an alert that something unusual is happening. Examples include:

A malware attack that is successfully blocked by your antivirus software.
Repeated failed login attempts that could indicate a brute force attack.
Your internal monitoring system flags an employee accessing a PHI file they don’t usually use.

Not every security incident is a breach, but every breach starts as a security incident.

When Does a Security Incident Become a Breach?

This transformation occurs when the incident results in unauthorized access to or disclosure of PHI. There are a few key factors to consider:

The Nature and Extent of the PHI Involved: Does the data include sensitive information like social security numbers or medical histories?
The Unauthorized Person Who Used the PHI or to Whom the Disclosure Was Made: Was it someone within the organization without proper authorization or an external actor?
Whether the PHI Was Actually Acquired or Viewed: Sometimes, data may be exposed but not necessarily accessed or viewed.
The Extent to Which the Risk to the PHI Has Been Mitigated: For example, if an unauthorized disclosure occurs, but the recipient agrees to destroy the information and not disclose it further.

Real-World Example

Let’s put this into a real-world context. Imagine a hospital employee clicks on a phishing email, which installs malware on their system. This is a security incident. It may not be a breach if the malware encrypts files but doesn’t access or transmit PHI outside the organization. However, if the malware transmits PHI to an external party, that’s a breach.

The Importance of Prompt Response

Regardless of whether an incident is a breach, quick action is crucial. HIPAA requires covered entities to have policies and procedures to address security incidents. This includes:

Conducting a thorough investigation.
Mitigating the harmful effects of the incident.
Documenting the incident and its outcomes.
Notifying the necessary parties if it’s determined to be a breach.

Conclusion

Understanding the difference between a security incident and a breach under HIPAA is more than a compliance requirement—it’s a vital part of protecting sensitive health information. By recognizing and responding appropriately to these events, healthcare providers and their business associates can better safeguard patient data against the ever-evolving landscape of cyber threats.

Do you have more questions about HIPAA, data security, or how to handle potential breaches? Don’t hesitate to reach out to us at Blue Goat Cyber. We’re here to help you navigate the complex cybersecurity terrain with confidence.

HIPAA Incident vs Breach FAQs

What is the difference between a HIPAA "incident" and a "breach"?

A HIPAA incident is any potential or actual unauthorized access, use, or disclosure of protected health information (PHI). A breach is a specific type of incident where the PHI is compromised, requiring notification under the HIPAA Breach Notification Rule, unless an assessment shows a low probability of compromise.

How does HHS define a breach under HIPAA?

A breach is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted by the HIPAA Privacy Rule that compromises the security or privacy of the information.

What is a HIPAA security incident?

A security incident is any attempted or successful unauthorized access, use, disclosure, modification, or destruction of ePHI (electronic PHI), or interference with an information system’s operations.

Are all HIPAA incidents considered breaches?

No. While all breaches are incidents, not all incidents are breaches. If a covered entity or business associate can demonstrate through a risk assessment that there is a low probability of PHI compromise, the incident may not be considered a reportable breach.

What factors are considered in a HIPAA breach risk assessment?

Per HHS guidance, four key factors must be evaluated:

Nature and extent of PHI involved
The unauthorized person who used or received the PHI
Whether the PHI was actually acquired or viewed
The extent to which the risk was mitigated

When does an incident become a reportable breach?

If the breach risk assessment does not demonstrate a low probability that PHI was compromised, then the incident must be reported to HHS and, in some cases, to affected individuals and the media.

What is the timeline for breach notification under HIPAA?

Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. HHS must also be notified, and if the breach affects 500 or more individuals, media notification is also required.

What are examples of incidents that may not be breaches?

An employee accessing their own medical record
PHI mistakenly sent to another covered entity that returns it without viewing
Encrypted data stolen without access to the encryption key

These must still be analyzed, but may not meet the threshold of a reportable breach.

What should an organization do after a HIPAA incident?

Conduct a prompt risk assessment, document findings, mitigate any risks, and determine if the incident is a breach. Also, review policies, retrain staff, and strengthen safeguards to prevent recurrence.

How can Blue Goat Cyber help with HIPAA incidents and breach management?

Blue Goat Cyber provides HIPAA-compliant incident response planning, risk assessments, and breach investigation support, helping organizations quickly determine breach status, document actions, and meet all regulatory notification requirements.