By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Breach (HIPAA Breach of Security)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Under HIPAA, a breach is when protected health information is obtained, accessed, used, or disclosed in a way the rules do not permit, that compromises its security or privacy. A breach can involve a cyberattack, but it can also result from a misdirected fax, a lost device, or an employee viewing records without a job-related reason.
The HIMSS Dictionary defines a breach of security as obtaining, accessing, using, or disclosing protected health information in a manner the Privacy Rule does not allow, or one that compromises the security or privacy of the information, as defined in the HIPAA regulations at 45 CFR 164.402.
HIPAA presumes that an impermissible use or disclosure is a breach unless the covered entity or business associate demonstrates a low probability that the information has been compromised, based on a risk assessment of at least four factors:
| Risk Assessment Factor | Question It Asks | Example |
|---|---|---|
| Nature and Extent of the PHI | What information was involved, and how identifiable and sensitive is it? | Diagnoses and Social Security numbers versus a name only |
| Unauthorized Recipient | Who received or used the information? | Another covered entity bound by HIPAA versus an unknown individual |
| Actual Acquisition or Viewing | Was the information actually viewed or acquired? | A returned, unopened envelope versus a document that was read |
| Mitigation | How much has the risk been reduced? | Written assurance from the recipient that the information was destroyed |
The definition also includes exceptions, such as unintentional good-faith access by a workforce member acting within the scope of authority, inadvertent disclosure between people authorized to access the information at the same organization, and situations where the recipient could not reasonably have retained the information.
⚠️ Exam Alert: A security incident is any attempted or successful unauthorized access or interference with systems; not every incident is a breach. A breach involves unsecured PHI compromised in a way HIPAA does not permit. PHI that is properly encrypted according to HHS guidance is generally not “unsecured,” so its loss may not require notification. Know the notification deadlines: individuals without unreasonable delay and within 60 days of discovery.
🌐 Why It Matters: Real-World Healthcare IT Context
Breach rules determine who must be told and when. Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Breaches affecting 500 or more residents of a state or jurisdiction also require notice to prominent media outlets. HHS must be notified as well: for breaches affecting 500 or more individuals, at the same time as individuals are notified, and for smaller breaches, in an annual log submitted within 60 days after the end of the calendar year. Business associates must notify the covered entity of breaches they discover.
HHS posts breaches affecting 500 or more individuals on its public breach portal, which makes large breaches visible to patients, regulators, and the press. Enforcement can follow, and resolution agreements and civil money penalties often cite failures such as missing risk analyses, inadequate access controls, or lack of encryption.
Encryption is one of the most important protections. HHS guidance describes how to render PHI unusable, unreadable, or indecipherable to unauthorized individuals through encryption or destruction. When lost laptops, phones, or backup media are encrypted according to that guidance, the loss is often not a reportable breach.
Breaches are not only technical. Insider snooping, wrong-patient mailings, misdirected faxes, and discussions in public spaces account for many incidents, which is why workforce training and privacy monitoring matter alongside cybersecurity.
Common causes of breaches:
- Phishing and ransomware attacks that expose or steal data
- Lost or stolen unencrypted devices
- Misdirected mail, faxes, and emails
- Workforce members accessing records without a job-related reason
- Improper disposal of paper records or devices
- Business associate incidents affecting many covered entities
Practices that reduce breach risk and impact:
- Encryption of laptops, mobile devices, and backups
- Multifactor authentication and phishing defenses
- Privacy monitoring of access patterns
- Verification steps for faxes, mailings, and email recipients
- Clear, fast incident reporting channels for staff
- A documented breach risk assessment and response process
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are often the first to notice a possible breach, and how quickly they report it shapes the response.
At the Bedside
Many breach scenarios happen in everyday clinical work: handing a patient someone else’s discharge papers, faxing records to the wrong number, leaving a census sheet in a public area, or discussing a patient where visitors can hear. Careful verification of names and identifiers before handing out paperwork, and keeping printed patient information secure, prevents many incidents.
If a mistake happens, reporting it immediately to the privacy office matters more than trying to fix it quietly. The organization’s clock for breach notification starts when the incident is discovered, and early reporting allows mitigation, such as retrieving the document or obtaining confirmation that it was destroyed.
In Clinical Workflow
Accessing a chart without a care-related reason, even out of concern for a coworker or family member, can be a privacy violation and may lead to breach analysis and discipline. Audit logs make this access visible.
Personal devices are another risk. Taking photos of patients or records on a personal phone, or sending patient information through unapproved apps, can expose PHI if the device is lost or the app is not secure.
In EHR Implementation (Go-Live Perspective)
Go-Live periods bring new risks, such as printed tip sheets with real patient screenshots, temporary workarounds involving paper, and new users unfamiliar with printing and faxing workflows. Using training patients for examples and securing paper during downtime reduce exposure.
At-the-elbow support analysts help by reinforcing secure printing, faxing, and messaging practices, and by directing staff to report suspected privacy incidents through the proper channel rather than handling them informally.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Breaches are a heavily tested HIPAA topic:
| CAHIMS Domain | How Breaches Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA Breach Notification Rule; OCR enforcement; public breach portal |
| Clinical Informatics | Everyday privacy practices; misdirected information; snooping |
| Healthcare Information & Systems Management | Encryption, access controls, audit logs, incident response |
| Management & Leadership | Risk assessment, notification decisions, business associate oversight, training |
Key Terms to Know Alongside Breach
- Unsecured PHI — PHI not rendered unusable, unreadable, or indecipherable to unauthorized individuals under HHS guidance
- Breach Notification Rule — HIPAA requirements for notifying individuals, HHS, and sometimes the media after a breach
- Security Incident — an attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems
- Four-Factor Risk Assessment — the analysis used to determine whether there is a low probability that PHI was compromised
- Business Associate — an entity handling PHI for a covered entity, which must report breaches to that entity
- Encryption — transforming data so it cannot be read without a key
HIMSS Organizational Position
HIMSS addresses breach prevention and response through its cybersecurity and privacy work, including its Healthcare Cybersecurity Community, and engages on breach notification and privacy policy through its public policy efforts. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.402, Definitions (Breach) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402
- HHS — Breach Notification Rule https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- HHS — Guidance to Render Unsecured PHI Unusable, Unreadable, or Indecipherable https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html
- HHS — Submitting Notice of a Breach to the Secretary https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html
- HHS OCR — Breach Portal https://ocrportal.hhs.gov/ocr/breach/breach_frontpage.jsf
- HHS — Resolution Agreements https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply