A security incident is any attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations. A breach is narrower and legally defined. A business associate must report security incidents under its contract and must notify of breaches of unsecured PHI within the rule's limit.
The two terms side by side
| Term | Plain meaning | Where it appears |
|---|---|---|
| Security incident | Attempted or successful unauthorized access, use, disclosure, modification or destruction, or interference with operations | Definitions section of the Security Rule |
| Breach of unsecured PHI | A defined event that triggers notification duties, with a risk assessment step | Breach notification rule |
Note the word attempted. A blocked scan or failed login attempt can meet the security incident definition. Most contracts therefore describe how routine events are reported, often as a periodic summary, while serious ones get immediate notice.
What the contract rules ask for
The business associate contract must provide that the associate will report to the covered entity any security incident it becomes aware of, including breaches of unsecured PHI. The breach notice itself must come without unreasonable delay and no later than 60 calendar days after discovery. Treat 60 days as an outer limit, not a target.
How to write the reporting clause
- Define a tiered scale. For example, successful unauthorized access to PHI gets notice within a short fixed window. Unsuccessful attempts get a quarterly summary.
- State who is notified and how, with a named contact and an out of hours route.
- List what the notice must include, such as systems affected, data types, timing and containment steps.
- Require updates as facts change.
- Require the vendor to pass the same terms to subcontractors.
Questions to ask in a review
- How do you detect an incident, and how long does it usually take to triage?
- Who decides whether an event is a breach, and do you share the assessment?
- Do you test the incident plan, and when did you last do it?
- Can we see an anonymised example of a past customer notice?
Answers tell you more about maturity than a policy document does.
Where to be careful
This post explains terms. Whether a given event is a reportable breach depends on facts and the risk assessment process, so involve counsel quickly.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is every security incident a breach?
No. A breach is a narrower, defined event. Many security incidents, such as blocked attempts, are not breaches.
Can a contract require faster notice than 60 days?
Yes. The 60 day limit is the outer boundary in the rule, and contracts commonly set shorter windows.
Sources
Last reviewed: 19 October 2026.
