--- title: "16 CFR 318.2 Health Breach Notification Rule: Definitions" canonical: "https://dposchool.com/health-breach-notification-rule/section/318.2" source: "https://www.ecfr.gov/current/title-16/section-318.2" source_note: "Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 318.2 Health Breach Notification Rule ยท Part 318: HEALTH BREACH NOTIFICATION RULE # 16 CFR 318.2 Health Breach Notification Rule: Definitions eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text Breach of security means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authorization of the individual. Unauthorized acquisition will be presumed to include unauthorized access to unsecured PHR identifiable health information unless the vendor of personal health records, PHR related entity, or third party service provider that experienced the breach has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information. A breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure. Business associate means a business associate under the Health Insurance Portability and Accountability Act, Public Law 104-191, 110 Stat. 1936, as defined in 45 CFR 160.103. Clear and conspicuous means that a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice. #### 16 CFR 318.2(1) **(1)** Reasonably understandable. You make your notice reasonably understandable if you: ##### 16 CFR 318.2(1)(i) **(i)** Present the information in the notice in clear, concise sentences, paragraphs, and sections; ##### 16 CFR 318.2(1)(ii) **(ii)** Use short explanatory sentences or bullet lists whenever possible; ##### 16 CFR 318.2(1)(iii) **(iii)** Use definite, concrete, everyday words and active voice whenever possible; ##### 16 CFR 318.2(1)(iv) **(iv)** Avoid multiple negatives; ##### 16 CFR 318.2(1)(v) **(v)** Avoid legal and highly technical business terminology whenever possible; and ##### 16 CFR 318.2(1)(vi) **(vi)** Avoid explanations that are imprecise and readily subject to different interpretations. #### 16 CFR 318.2(2) **(2)** Designed to call attention. You design your notice to call attention to the nature and significance of the information in it if you: ##### 16 CFR 318.2(2)(i) **(i)** Use a plain-language heading to call attention to the notice; ##### 16 CFR 318.2(2)(ii) **(ii)** Use a typeface and type size that are easy to read; ##### 16 CFR 318.2(2)(iii) **(iii)** Provide wide margins and ample line spacing; ##### 16 CFR 318.2(2)(iv) **(iv)** Use boldface or italics for key words; and ##### 16 CFR 318.2(2)(v) **(v)** In a form that combines your notice with other information, use distinctive type size, style, and graphic devices, such as shading or sidebars, when you combine your notice with other information. The notice should stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood. #### 16 CFR 318.2(3) **(3)** Notices on websites or within-application messaging. If you provide a notice on a web page or using within-application messaging, you design your notice to call attention to the nature and significance of the information in it if you use text or visual cues to encourage scrolling down the page if necessary to view the entire notice and ensure that other elements on the website or software application (such as text, graphics, hyperlinks, or sound) do not distract attention from the notice, and you either: ##### 16 CFR 318.2(3)(i) **(i)** Place the notice on a screen that consumers frequently access, such as a page on which transactions are conducted; or ##### 16 CFR 318.2(3)(ii) **(ii)** Place a link on a screen that consumers frequently access, such as a page on which transactions are conducted, that connects directly to the notice and is labeled appropriately to convey the importance, nature and relevance of the notice. Covered health care provider means a provider of services (as defined in 42 U.S.C. 1395x(u)), a provider of medical or other health services (as defined in 42 U.S.C. 1395x(s)), or any other entity furnishing health care services or supplies. Electronic mail means email in combination with one or more of the following: text message, within-application messaging, or electronic banner. Health care services or supplies means any online service such as a website, mobile application, or internet-connected device that provides mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, diet, or that provides other health-related services or tools. HIPAA-covered entity means a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), Public Law 104-191, 110 Stat. 1936, as defined in 45 CFR 160.103. Personal health record (PHR) means an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual. PHR identifiable health information means information that: #### 16 CFR 318.2(1) **(1)** Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and ##### 16 CFR 318.2(1)(i) **(i)** Identifies the individual; or ##### 16 CFR 318.2(1)(ii) **(ii)** With respect to which there is a reasonable basis to believe that the information can be used to identify the individual; and #### 16 CFR 318.2(2) **(2)** Is created or received by a: ##### 16 CFR 318.2(2)(i) **(i)** Covered health care provider; ##### 16 CFR 318.2(2)(ii) **(ii)** Health plan (as defined in 42 U.S.C. 1320d(5)); ##### 16 CFR 318.2(2)(iii) **(iii)** Employer; or ##### 16 CFR 318.2(2)(iv) **(iv)** Health care clearinghouse (as defined in 42 U.S.C. 1320d(2)); and #### 16 CFR 318.2(3) **(3)** With respect to an individual, includes information that is provided by or on behalf of the individual. PHR related entity means an entity, other than a HIPAA-covered entity or an entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, that: #### 16 CFR 318.2(1) **(1)** Offers products or services through the website, including any online service, of a vendor of personal health records; #### 16 CFR 318.2(2) **(2)** Offers products or services through the websites, including any online service, of HIPAA-covered entities that offer individuals personal health records; or #### 16 CFR 318.2(3) **(3)** Accesses unsecured PHR identifiable health information in a personal health record or sends unsecured PHR identifiable health information to a personal health record. State means any of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. Third party service provider means an entity that: #### 16 CFR 318.2(1) **(1)** Provides services to a vendor of personal health records in connection with the offering or maintenance of a personal health record or to a PHR related entity in connection with a product or service offered by that entity; and #### 16 CFR 318.2(2) **(2)** Accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information as a result of such services. Unsecured means PHR identifiable information that is not protected through the use of a technology or methodology specified by the Secretary of Health and Human Services in the guidance issued under section 13402(h)(2) of the American Reinvestment and Recovery Act of 2009, 42 U.S.C. 17932(h)(2). Vendor of personal health records means an entity, other than a HIPAA-covered entity or an entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, that offers or maintains a personal health record. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 318.2 on eCFR](https://www.ecfr.gov/current/title-16/section-318.2) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [Health Breach Notification Rule Navigator](https://dposchool.com/health-breach-notification-rule) / 16 CFR 318.2 Previous: [16 CFR 318.1 Health Breach Notification Rule: Purpose and scope](https://dposchool.com/health-breach-notification-rule/section/318.1) Next: [16 CFR 318.3 Health Breach Notification Rule: Breach notification requirement](https://dposchool.com/health-breach-notification-rule/section/318.3) ## For AI agents - Machine-readable index: https://dposchool.com/health-breach-notification-rule/llms.txt - JSON API: https://dposchool.com/health-breach-notification-rule/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents