Context
Organizations should document facts, analysis, exceptions, and notification decisions.
Example
A lost device containing unsecured PHI can require a documented breach analysis.
References
- Breach Notification Rule HHS Office for Civil Rights
HIPAA Glossary
Breach
An impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI, subject to the rule's exceptions and risk analysis framework.
Reviewed August 2026