SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-four-factor-risk-assessment

How many factors are used in a HIPAA breach risk assessment?

Four factors to decide if PHI was compromised.

Start playing free

  1. Two factors
  2. Four factors ✔
  3. Six factors

Why: To decide whether PHI was compromised, the covered entity weighs at least four factors. If they show a low probability of compromise, it does not have to send breach notices.

Huh, didn't know that: The rule says "at least" four factors, so an organization may weigh more.

The dad joke
Why did the risk assessment bring three friends? It did not want to decide alone.
Like this card?
Play the game

References

Answer: Four factors. To decide whether PHI was compromised, the covered entity weighs at least four factors. If they show a low probability of compromise, it does not have to send breach notices.

  1. 45 CFR 164.402 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402
    based on a risk assessment of at least the following factors
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsWhat is the first factor in a HIPAA breach risk assessment?

That's stuff everyone should know.