What triggers HIPAA breach notification requirements?

• A. Not all PHI breaches require notification.
• B. HIPAA breach notification is triggered by unsecured PHI disclosure or access; affected individuals, and sometimes HHS and the media, must be notified.
• C. Notification is only required if more than 1000 individuals are affected.
• D. Notification is required for all breaches, regardless of risk.

Answer: (B)

The trigger for HIPAA breach notification is when there is an impermissible disclosure or access to PHI that is unsecured. In practical terms, if PHI is not encrypted or otherwise protected and becomes accessible or disclosed in a way that could compromise privacy, that situation requires evaluating for a breach. If it is determined to be a breach, the affected individuals must be notified, and in certain cases—typically for larger breaches—the HHS and the media must also be notified. This is why the correct explanation emphasizes unsecured PHI and who must be told: those directly affected, and sometimes regulatory bodies and the media, depending on the breach size.