The information is not further acquired, accessed, used, or disclosed by anyone. There has been an unintentional acquisition, access, or use of PHI by a workforce member or other person acting under a CE's or BA's authority, and the acquisition, access, or use was made in good faith and within the course and scope of the person's employment (or other professional relationship) with the CE or BA and What Scenarios are Excluded from the Definition of the Word “Breach”?īy definition, certain incidents do not qualify as breaches. Subject to three exceptions discussed below, a “breach” is an unauthorized acquisition, access, use, or disclosure of PHI, in a manner not permitted under the Privacy Rule, that compromises the PHI's privacy or security. The rule also requires business associates (BAs) to notify covered entities following the business associates’ discovery of a breach of unsecured protected health information.

The HIPAA Breach Notification Rule (BNR) requires that covered entities (CEs), following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.

Define breach notification hipaa