---
title: "Handle a US health-privacy incident as HIPAA plus Rule 1.6"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R3-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-09-23"
---

# Handle a US health-privacy incident as HIPAA plus Rule 1.6

> Sort the incident facts into covered-entity / business-associate / other, and list data elements that may be PHI.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/united-states  
Last reviewed: 2026-09-23

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Sort the incident facts into covered-entity / business-associate / other, and list data elements that may be PHI. |
| What the lawyer must review | Open the HHS covered-entity and business-associate pages Check whether the firm needs a BAA to handle PHI Do not put the incident file into a public generative tool |
| Written for | United States |
| Applies to | [Assess a suspected data breach and draft the notification pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack.md) |

## Checking plan

- What the AI does: Sort the incident facts into covered-entity / business-associate / other, and list data elements that may be PHI.
- Basis: Checked against the linked sources on 23 September 2026. Confirm the current instrument before reliance.

## Sources

- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-09-23)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-09-23)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*