# What is a data breach under US law?

US law has no single definition. HIPAA presumes an impermissible use of health data is a breach, and state laws differ on whether access alone counts.

Updated: October 16, 2026

A data breach, in US law, is whatever the rule that covers your data says it is. Federal rules and state laws each define it for the data they cover. HIPAA has one for health information held by the organizations it covers (health plans, most health care providers and clearinghouses) and their business associates. The Federal Trade Commission (FTC) has one for health apps outside HIPAA. States write their own for personal information such as Social Security and account numbers. One difference matters when a former employee signs back in: whether someone only seeing the data is enough.

## How does HIPAA define a breach?

HIPAA's definition sits in 45 CFR 164.402. A breach is "the acquisition, access, use, or disclosure" of protected health information in a way the Privacy Rule doesn't permit. It must also "compromise the security or privacy" of that information.

The section then starts from the assumption that a breach happened. Any access, use or disclosure the Privacy Rule doesn't allow counts as one. The organization can overcome that only with a risk assessment showing a low probability that the information was compromised. What your logs need to show for it is covered in [what access logs need to show when you decide whether to report a breach](/guides/compliance/breach-notification-access-logs).

Three cases are excluded. The first is unintentional access in good faith by a workforce member acting within their authority, with no further impermissible use. The second is an inadvertent disclosure between two people at the same organization who are both allowed to see the information. The third is a disclosure where the organization believes in good faith that the recipient couldn't have kept the information.

## What about health apps outside HIPAA?

The FTC's Health Breach Notification Rule, 16 CFR Part 318, covers vendors of personal health records, related companies and their service providers. It excludes organizations covered by HIPAA, and companies acting as their business associates.

Under 318.2, a "breach of security" is acquisition of unsecured health information in a personal health record without the person's authorization. If someone got unauthorized access, the rule presumes they acquired the information. The company can rebut that only with reliable evidence that no unauthorized acquisition happened, or could reasonably have happened. The definition also covers acquisition that comes from "an unauthorized disclosure," so a breach under this rule doesn't need an outside attacker.

## Do state laws count access, or only acquisition?

It depends on the state. New York's General Business Law 899-aa counts "unauthorized access to or acquisition of" computerized data that compromises private information. To decide whether data was accessed, a business may look for signs it was "viewed, communicated with, used, or altered" by someone without valid authorization.

Washington's RCW 19.255.005 names only "unauthorized acquisition."

Both states treat a login as protected data. Each covers a username or email address together with the password that opens an online account.

## Does an employee's own access count?

HIPAA, New York and Washington each exclude good-faith access by an employee or workforce member acting for the organization, as long as the information isn't misused afterward. Those exceptions describe someone doing their job. They don't read as covering a person who has left and signs back in.

People who cause a breach this way are what CISA, the federal cybersecurity agency, calls insiders. See [What is an insider threat?](/guides/incidents/what-is-insider-threat). For when a sign-in is itself a federal crime, see [What is unauthorized access under the CFAA?](/guides/incidents/what-is-unauthorized-access-cfaa).


## Frequently asked questions

**Is it a breach if a former employee only looked at patient records?**

Under HIPAA it's presumed to be one if the access wasn't permitted. You can rebut that only with a risk assessment showing a low probability that the information was compromised.

**Does a leaked username and password count as breached data?**

In New York and Washington, yes. Both cover a username or email address together with the password that opens an online account.

**Do health apps follow HIPAA's breach rule?**

Not if they aren't covered by HIPAA. The FTC's Health Breach Notification Rule covers vendors of personal health records and related companies, and it excludes organizations covered by HIPAA and their business associates.

## Sources

- [45 CFR 164.402, Definitions (Cornell LII)](https://www.law.cornell.edu/cfr/text/45/164.402)
- [16 CFR 318.1, Purpose and scope (Cornell LII)](https://www.law.cornell.edu/cfr/text/16/318.1)
- [16 CFR 318.2, Definitions (Cornell LII)](https://www.law.cornell.edu/cfr/text/16/318.2)
- [New York General Business Law 899-aa, Notification; person without valid authorization has acquired private information (New York State Senate)](https://www.nysenate.gov/legislation/laws/GBS/899-AA)
- [Washington RCW 19.255.005, Definitions (Washington State Legislature)](https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.005)
- [CISA: Defining Insider Threats](https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats)

## How Junify handles this

**Doing this by hand** To avoid the same kind of incident, you stop every login a person could use each time they leave or a contract ends. You change the shared passwords they knew and send the new ones to everyone who stays. And someone has to check the sign-in records on a regular schedule.

**With Junify** Each definition here leads to the same first question: who got into what. On a shared login, the service's record names the account, not the person. Junify records which person opened which account and when, because each person verifies on their own phone first. People never see the password, so they have none to take with them, and the admin removes a person's access in Junify when they leave.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=incidents&slug=what-is-data-breach)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [A vendor's stolen login opened a retailer's network (2013) and what it shows about vendor remote access](/guides/incidents/contractor-pc-malware-shared-auth): A Senate staff report says attackers stole a contractor's login through infected email and used it to enter a national retailer's network.
- [Vendor call-center staff opened 68,701 customer accounts without authorization (2014) and what it shows about reviewing vendor access](/guides/incidents/contractor-sent-data-outside): For 168 days, three workers at a carrier's call-center vendor opened 68,701 customer accounts without authorization and collected personal details.
- [A former contractor used a shared cloud admin key (2018) and what it shows about shared admin logins](/guides/incidents/contractor-shared-admin-account): An online education company shared one full-access cloud key with staff and contractors. A former contractor used it to take data on about 40 million users.