HIPAA presumes that an impermissible acquisition, access, use or disclosure of protected health information is a breach. The entity can rebut the presumption only by showing a low probability that the PHI was compromised, based on a risk assessment of four factors. This is educational, not legal advice.
The presumption flips the burden
Many teams assume that an incident is not reportable until someone proves harm. The regulation at 45 CFR 164.402 works the other way. If PHI was handled in a way the Privacy Rule does not permit, you start from "breach". Notification can be avoided only by documenting why compromise is improbable.
There are also three exclusions in the definition: good faith, unintentional access by an authorised workforce member; inadvertent disclosure between authorised people at the same entity or arrangement; and disclosures where the recipient could not reasonably have retained the information.
The four factors
The text lists these considerations for the assessment.
- The nature and extent of the PHI. What identifiers were involved, and how likely is re-identification?
- The unauthorised person. Who used the PHI or received the disclosure? Another covered entity bound by similar duties is different from an unknown party.
- Whether PHI was actually acquired or viewed. Access logs matter. A laptop that was recovered with forensic proof that files were never opened is different from one that vanished.
- The extent of mitigation. Did you get credible assurances the recipient destroyed the data?
Where engineering evidence comes in
Factors three and four are evidence questions, and engineers hold the evidence.
- For factor three you need audit logs that show reads, exports and downloads, not just logins. If logging does not capture object level access, you cannot make the low probability argument and you will probably have to notify.
- For factor two you need to trace where data went. A misdirected email to a known partner is traceable. A public bucket is not.
- For factor one you need to know exactly which fields were in the exposed system. A current data inventory shortens this from days to hours.
Writing the assessment
Keep it short and dated. State the facts, walk through each of the four factors, name the evidence relied on, and give the conclusion. Have privacy or counsel sign it. Keep the file with other breach records, since the rule expects you to be able to show how you reached the decision.
Common errors
Treating "no evidence of misuse" as proof of no compromise. The factors ask about acquisition and viewing, not whether harm has been reported.
Deciding too quickly. If logging is incomplete, say so in the assessment rather than assume the best case.
Skipping the assessment when the answer seems obvious. The presumption means a written conclusion is the safer habit.
Quick check
Is a risk assessment always required?
It is the route to rebut the presumption of breach. If you notify without rebutting, you can proceed on the notification deadlines, but you still document the incident.
Do the factors apply to a stolen encrypted laptop?
The factors apply to any incident under assessment. Whether the data counts as unsecured PHI is a separate question to confirm with counsel.
Sources
Last reviewed: 19 October 2026.
