---
title: "Assess a suspected breach of unsecured protected health information"
url: "https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A32-R20261018-4-US"
practice_area: "Health & Medical Law"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Assess a suspected breach of unsecured protected health information

> Extract the date of discovery, whose information is involved, whether it was encrypted or destroyed, and whether a business associate or the covered entity holds it.…

Canonical page: https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Health & Medical Law](https://ailawframework.com/practice/health-and-medical-law.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Extract the date of discovery, whose information is involved, whether it was encrypted or destroyed, and whether a business associate or the covered entity holds it. Do not decide that notification is required and do not draft the notice. |
| What the lawyer must review | HHS states that 45 CFR §§ 164.400-414 require covered entities and business associates to notify after a breach of unsecured protected health information. Unsecured means the information has not been rendered unusable, unreadable or indecipherable by the encryption or destruction methods in the HHS guidance. Individual notice must be without unreasonable delay and no later than 60 days after discovery. A breach affecting more than 500 residents of a state or jurisdiction also requires media notice. The Secretary is notified as well. A business associate notifies the covered entity. You decide whether there is a breach and whether an exception applies. You write any notice. |
| Written for | United States |
| Applies to | [Assess a suspected data breach of patient information and decide whether to notify](https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether.md) |

## Checking plan

- What the AI does: Extract the date of discovery, whose information is involved, whether it was encrypted or destroyed, and whether a business associate or the covered entity holds it. Do not decide that notification is required and do not draft the notice.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The 60-day period runs from discovery of a breach of unsecured protected health information, not from the first rumour.
- Do not put the affected patient list into a public tool.

## Sources

- [HHS: HIPAA Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) (checked 2026-10-22)
- [45 CFR § 164.502 (uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (checked 2026-10-22)
- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Eligible data breach assessment record](https://ailawframework.com/precedents/health-and-medical-law/eligible-data-breach-assessment.md) | Form | Red | Record for deciding whether a loss of, or unauthorised access to, personal information is an eligible data breach that must be notified. The officer makes the decision. |
| [HIPAA use and disclosure limits checklist](https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits.md) | Checklist | Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. It does not authorise a use. |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*