SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-breach-definition

What is a HIPAA breach?

A breach is a use or disclosure not allowed by the Privacy Rule that compromises the PHI.

Start playing free

  1. Any time a work laptop is lost, even if encrypted
  2. A disallowed use or disclosure that compromises PHI ✔
  3. Only when paper charts are stolen from a locked room

Why: HIPAA defines a breach as getting, viewing, using or sharing PHI in a way the Privacy Rule does not allow, which compromises its security or privacy. Lost encrypted data is not unsecured PHI.

Huh, didn't know that: A worker's accidental, good-faith look at PHI within their job is not a breach, as long as it goes no further.

The dad joke
Why did the filing cabinet get a promotion? It never let a single secret slip.
Like this card?
Play the game

References

Answer: A disallowed use or disclosure that compromises PHI. HIPAA defines a breach as getting, viewing, using or sharing PHI in a way the Privacy Rule does not allow, which compromises its security or privacy. Lost encrypted data is not unsecured PHI.

  1. 45 CFR 164.402 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402
    Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?Work SkillsWhat is the first factor in a HIPAA breach risk assessment?

That's stuff everyone should know.