The Definition of Breach

This posting is one of several that outline the HITECH privacy provisions of the American Recovery and Reinvestment Act that President Obama signed into law on Tuesday, February 17, 2009, in Denver, CO. Here, we reproduce the definitions that appear in Subtitle D—Privacy, Section 13400. Definitions, that appear in the Conference Report on page H1345 of Congressional Record—House, February 12, 2009. These definitions are critical in understanding the content of the new HITECH privacy provisions and how they relate to existing HIPAA Administrative Simplification Privacy Rule standards.

HIPAA Privacy Definitions:

Business Associate
Covered Entity
Electronic Health Record
Health Care Operations
Health Care Provider
Health Plan
National Coordinator
Personal Health Record
Protected Health Information
Vendor Of Personal Health Records


(A) IN GENERAL. The term ‘breach’ means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.

(B) EXCEPTIONS. The term ‘breach’ does not include—

(i) Any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—

(1) Such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and

(2) Such information is not further acquired, accessed, used, or disclosed by any person;

(ii) Any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at same facility; and

(iii) Any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.

Comments on “The Definition of Breach”

  1. I was forced to disclose my protected medical condition at a local jail to a Correctional officer, in front of other jail inmates, and correctional individuals. I was also beaten by such individuals as a result of such forced disclosure of having HIV. This individual was not a Nurse. Is this okay?

Leave a Reply

Your email address will not be published. Required fields are marked *