A medical information data breach happens when someone gets access to health information they were not allowed to have. If your health information was exposed, federal law generally requires the health organization to notify you in writing within 60 days of discovering the breach. It must explain what happened and what was exposed. Separate federal rights let you freeze your credit files.
Most people facing a letter like this are reading it at the kitchen table, unsure whether it is routine paperwork or something serious. The letter names a hospital, a clinic or a health plan, mentions a "security incident," and lists information that may include a diagnosis or an insurance number. The questions that follow are practical. Was this a real breach? Did the organization tell me what it had to? Could someone use my information to get care or open accounts in my name? This page explains what federal law says about each of those questions, and where federal credit-reporting rights come in.
HIPAA's Breach Notification Rule, issued by the U.S. Department of Health and Human Services (HHS), is the federal rule that decides when a health information breach triggers a duty to notify. According to the HHS Breach Notification Rule page, the rule requires "HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information."
Three terms carry the weight here. Protected health information, often shortened to PHI, means health information that identifies a person and is held by an organization HIPAA covers. A covered entity is the rule's term for the health organizations HIPAA directly regulates. A business associate is a company that handles PHI on a covered entity's behalf, such as a billing or records vendor.
The duty applies to unsecured PHI. That word matters, because HIPAA sets standards for protecting PHI so it cannot be read or used if it is taken. Not every improper use of PHI ends up as a reportable breach. The organization weighs the risk, and the factors HHS lists include the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification. They also include the extent to which the risk has been mitigated.
What Notice a Covered Entity Must Provide After a Breach
Under 45 C.F.R. § 164.404(a), a covered entity must notify each person whose unsecured PHI "has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach." A breach counts as discovered on the first day the entity knows of it, or would have known by exercising reasonable diligence.
Timing is generally fixed. The notice must go out "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach," subject to a narrow exception in the regulation.
The notice must be in plain language and must include, to the extent possible:
- a brief description of what happened, including the date of the breach and the date it was discovered, if known;
- the types of unsecured PHI involved;
- any steps individuals should take to protect themselves;
- what the covered entity is doing to investigate, reduce harm and prevent further breaches;
- contact procedures for questions, including a toll-free number, an email address, a website or a postal address.
HHS says individual notice goes by first-class mail, or by email if the person agreed to electronic notice. Where contact information is out of date for 10 or more people, the entity must give substitute notice. That means posting the notice on its website home page for at least 90 days or using major print or broadcast media. HHS adds that a breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area.
Medical Identity Theft: When a Breach Leads to Misuse of Your Health Information
Medical identity theft is the use of another person's name, insurance details or other identifying information to get medical care or prescription drugs, or to submit claims for care. It differs from financial identity theft in one important way. A fraudulent credit account can be closed, but an entry made in someone's medical record can travel with that record into future care.
The harms that can follow include inaccurate entries in medical records, incorrect information on insurance records, and bills for care the person never received. The record a doctor relies on later could reflect someone else's visit.
A person who suspects this may request a copy of their records from the provider. They may also compare the Explanation of Benefits statements from their health plan against the care they actually received. Financial misuse is a separate track, discussed in more detail on this site's page about identity theft after a breach.
Federal credit-reporting law also gives weight to an identity theft report. Under 15 U.S.C. § 1681c-1(b), submitting one to a nationwide consumer reporting agency is what unlocks the extended fraud alert. The FTC's guidance on credit freezes and fraud alerts says the extended alert is available to people who have experienced identity theft and have completed an FTC identity theft report at IdentityTheft.gov or filed a police report.
The HHS Office for Civil Rights and How Breach Complaints Work
The HHS breach notification page explains that covered entities must notify the Secretary of HHS of breaches of unsecured protected health information. The HHS Office for Civil Rights is the federal office that administers HIPAA's breach rules.
Reporting to HHS runs on two tracks under 45 C.F.R. § 164.408. For breaches involving 500 or more individuals, the covered entity must notify the Secretary of HHS at the same time it notifies individuals, generally, in the manner HHS specifies on its website. For breaches involving fewer than 500 individuals, the entity keeps a log. It then reports those breaches no later than 60 days after the end of each calendar year. HHS says covered entities make these reports by filling out and submitting a breach report form electronically on the HHS website.
For a reader holding a notice, these rules explain something that is easy to miss. A breach that touches many people is reported to the federal government alongside the letters. A smaller breach may reach HHS only in the following year's report.
HHS also accepts complaints from people who believe a covered entity did not follow HIPAA. It describes that process on its own website. What happens with any complaint depends on its facts, and filing one does not lead to any set result.
Federal and State Laws That May Apply Beyond HIPAA
HIPAA reaches only covered entities and their business associates. A company outside those categories, such as some health apps and online services, is not subject to HIPAA's breach rules just because it holds health information. Whether a particular company is a covered entity depends on what it does and the facts.
Some of those companies fall under a different federal rule. HHS notes that "similar breach notification provisions implemented and enforced by the Federal Trade Commission" apply to vendors of personal health records and their third-party service providers. Under 16 C.F.R. § 318.3, after discovering a breach of unsecured health information in a personal health record, a vendor must notify each affected U.S. citizen or resident and the FTC. A related company covered by the rule must do the same. If 500 or more residents of a state or jurisdiction are affected, the vendor or company must also notify prominent media outlets serving it.
State law may add protections, and it differs from state to state. Some states have their own breach notice laws and their own health privacy laws. This site's page on data breach notification rights covers notice duties more broadly.
The regulation itself lists the kinds of information a breach notice may describe. The types named in 45 C.F.R. § 164.404(c) include "full name, social security number, date of birth, home address, account number, diagnosis, disability code," among others. A single medical breach can therefore expose identity details, financial details and health details at once.
Health information is unusual among exposed data. A credit card can be replaced, but a diagnosis or a treatment history cannot be changed. A medical breach can also open two paths of misuse at the same time. One leads toward medical care and insurance claims, and the other toward credit accounts. Possible consequences include:
- claims submitted in the person's name;
- incorrect entries in medical records;
- prescriptions obtained using the person's identity;
- fraudulent financial accounts.
None of these follow automatically from a breach. Many people who receive a notice see no misuse at all. What, if anything, happens depends on what was taken and who has it. The page on personal information exposed addresses non-medical data in more depth.
Steps a Person Can Take After Receiving a Breach Notice
The breach notice itself is the first source of facts. It lists the types of information involved and gives a way to ask questions. A person may read it for both.
On the credit side, federal law provides two tools. A security freeze is a restriction that stops a nationwide consumer reporting agency from releasing a person's credit report. A consumer reporting agency is a company that compiles credit files, and the nationwide ones are Equifax, Experian and TransUnion. Under 15 U.S.C. § 1681c-1(i), a freeze is free. The agency must place it within 1 business day of a request made by toll-free telephone or secure electronic means, or 3 business days after a request by mail. The agency must remove it within 1 hour of a phone or electronic request, or 3 business days after a request by mail.
The CFPB's page on security freezes says a person must contact each nationwide company separately. It also says the federal free-freeze law does not apply to someone requesting the report for employment, tenant-screening or insurance purposes.
A fraud alert is a notice in a credit file telling businesses to take steps to verify identity before extending new credit. Under 15 U.S.C. § 1681c-1(a), a person who asserts in good faith a suspicion of fraud or identity theft may request an initial alert. It lasts at least 1 year, and the agency must refer it to the other nationwide agencies. An extended alert under § 1681c-1(b) requires an identity theft report and lasts 7 years. It also removes the person from prescreened credit and insurance offer lists for 5 years and allows 2 free file copies in the following 12 months.
A person may also check Explanation of Benefits statements and medical records for unfamiliar entries. They may file a complaint with HHS if they believe a covered entity violated HIPAA. They may also report suspected identity theft to the FTC at IdentityTheft.gov. Where billing or bank data was exposed, the page on a financial data breach explains that side.
If You'd Like a Consumer Rights Case Review
A medical breach notice can raise questions that sit on two tracks: what the health organization had to tell people, and what later appeared on a credit report or in insurance records. A conversation can cover the notice and its dates, which organization sent it, and any unfamiliar accounts, claims or bills. It can also cover any fraud alert, freeze or dispute already requested, with the answers received. This page explains the federal framework and does not address any particular breach or company.
To discuss a situation like this with an attorney, a reader may request a consumer rights case review through Federal Consumer Rights.
