--- title: "45 CFR 164.402 HIPAA: Definitions" canonical: "https://dposchool.com/hipaa/section/164.402" source: "https://www.ecfr.gov/current/title-45/section-164.402" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.402 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information # 45 CFR 164.402 HIPAA: Definitions eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text As used in this subpart, the following terms have the following meanings: Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. #### 45 CFR 164.402(1) **(1)** Breach excludes: ##### 45 CFR 164.402(1)(i) **(i)** Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part. ##### 45 CFR 164.402(1)(ii) **(ii)** Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part. ##### 45 CFR 164.402(1)(iii) **(iii)** A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information. #### 45 CFR 164.402(2) **(2)** Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors: ##### 45 CFR 164.402(2)(i) **(i)** The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification; ##### 45 CFR 164.402(2)(ii) **(ii)** The unauthorized person who used the protected health information or to whom the disclosure was made; ##### 45 CFR 164.402(2)(iii) **(iii)** Whether the protected health information was actually acquired or viewed; and ##### 45 CFR 164.402(2)(iv) **(iv)** The extent to which the risk to the protected health information has been mitigated. Unsecured protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111-5. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[78 FR 5695, Jan. 25, 2013\] [45 CFR 164.402 on eCFR](https://www.ecfr.gov/current/title-45/section-164.402) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.402 Previous: [45 CFR 164.400 HIPAA: Applicability](https://dposchool.com/hipaa/section/164.400) Next: [45 CFR 164.404 HIPAA: Notification to individuals](https://dposchool.com/hipaa/section/164.404) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents