What is a data breach under US law?

A data breach, in US law, is whatever the rule that covers your data says it is. Federal rules and state laws each define it for the data they cover. HIPAA has one for health information held by the organizations it covers (health plans, most health care providers and clearinghouses) and their business associates. The Federal Trade Commission (FTC) has one for health apps outside HIPAA. States write their own for personal information such as Social Security and account numbers. One difference matters when a former employee signs back in: whether someone only seeing the data is enough.

How does HIPAA define a breach?

HIPAA’s definition sits in 45 CFR 164.402. A breach is “the acquisition, access, use, or disclosure” of protected health information in a way the Privacy Rule doesn’t permit. It must also “compromise the security or privacy” of that information.

The section then starts from the assumption that a breach happened. Any access, use or disclosure the Privacy Rule doesn’t allow counts as one. The organization can overcome that only with a risk assessment showing a low probability that the information was compromised. What your logs need to show for it is covered in what access logs need to show when you decide whether to report a breach.

Three cases are excluded. The first is unintentional access in good faith by a workforce member acting within their authority, with no further impermissible use. The second is an inadvertent disclosure between two people at the same organization who are both allowed to see the information. The third is a disclosure where the organization believes in good faith that the recipient couldn’t have kept the information.

What about health apps outside HIPAA?

The FTC’s Health Breach Notification Rule, 16 CFR Part 318, covers vendors of personal health records, related companies and their service providers. It excludes organizations covered by HIPAA, and companies acting as their business associates.

Under 318.2, a “breach of security” is acquisition of unsecured health information in a personal health record without the person’s authorization. If someone got unauthorized access, the rule presumes they acquired the information. The company can rebut that only with reliable evidence that no unauthorized acquisition happened, or could reasonably have happened. The definition also covers acquisition that comes from “an unauthorized disclosure,” so a breach under this rule doesn’t need an outside attacker.

Do state laws count access, or only acquisition?

It depends on the state. New York’s General Business Law 899-aa counts “unauthorized access to or acquisition of” computerized data that compromises private information. To decide whether data was accessed, a business may look for signs it was “viewed, communicated with, used, or altered” by someone without valid authorization.

Washington’s RCW 19.255.005 names only “unauthorized acquisition.”

Both states treat a login as protected data. Each covers a username or email address together with the password that opens an online account.

Does an employee’s own access count?

HIPAA, New York and Washington each exclude good-faith access by an employee or workforce member acting for the organization, as long as the information isn’t misused afterward. Those exceptions describe someone doing their job. They don’t read as covering a person who has left and signs back in.

People who cause a breach this way are what CISA, the federal cybersecurity agency, calls insiders. See What is an insider threat?. For when a sign-in is itself a federal crime, see What is unauthorized access under the CFAA?.