Under HIPAA breach notification requirements, which entities may be notified beyond the affected individuals?

• A. The hospital board must be notified.
• B. The affected individuals, and in many cases the U.S. Department of Health and Human Services and possibly the media, must be notified.
• C. No other parties are notified.
• D. The patient's employer must be notified.

Answer: (B)

When a breach of unsecured PHI occurs, HIPAA requires more than just telling the affected individuals. The entity must also report the breach to the U.S. Department of Health and Human Services (OCR). If the breach is large—affecting 500 or more individuals—the breach must also be announced to the media serving the affected area. The hospital board and the patient’s employer are not standard recipients required by HIPAA breach-notification rules; internal governance may involve the board, but external reporting to the board or the employer isn’t a mandated part of breach notifications under HIPAA.