The short answer
Under HIPAA, an acquisition, access, use or disclosure of PHI that the Privacy Rule doesn’t permit is presumed to be a breach, unless a documented risk assessment of at least four factors shows a low probability the PHI was compromised.1 If an AI vendor (a business associate) discovers a breach of unsecured PHI, it must tell the covered entity without unreasonable delay and within 60 calendar days.3 The covered entity then notifies affected individuals within 60 days of its own discovery, the media if more than 500 residents of a state are affected, and HHS.2 This is a summary, not legal advice.
Deedglass
A sealed record you can check offline
Record 1043
- What ran
- Medication order, Bed 12
- Approved by
- Dr. N. Shah
- Check
- Matches
- Time
- 09:12
- The request
- Not keptA fingerprint only: 77d2…c41a
Each record is linked to the one before
- Record 1041
- Record 1042
- Record 1043
What counts as a breach
The definition covers PHI acquired, accessed, used or disclosed in a way the Privacy Rule doesn’t permit, which compromises its security or privacy.1 Three narrow exclusions apply: good-faith, unintentional access by workforce acting within their authority with no further misuse; inadvertent disclosure between people authorised at the same organisation; and disclosure to someone who couldn’t reasonably have kept the information.1
Only unsecured PHI triggers notification: PHI not rendered unusable, unreadable or indecipherable to unauthorised people by a method in HHS guidance.1 Properly encrypted data that leaks without its key usually falls outside notification; that’s one reason encryption terms matter in AI vendor contracts.
The four-factor risk assessment
If none of the exclusions applies, the presumption is breach unless you show low probability of compromise, assessing at least:1
| Factor | Question | AI example |
|---|---|---|
| 1. Nature and extent | What PHI, which identifiers, how easily re-identified? | A note with name, MRN and diagnosis vs a de-identified snippet |
| 2. Unauthorised person | Who got it? | Another clinician at a partner hospital vs an unknown website |
| 3. Acquired or viewed | Was it actually opened? | Logs show the misdirected message was never read |
| 4. Mitigation | How far was the risk reduced? | Recipient confirmed deletion in writing |
Write the assessment down. “We think it’s fine” isn’t an assessment.
The clocks
| Who | Notifies | Deadline | Source |
|---|---|---|---|
| Business associate (AI vendor) | Covered entity | Without unreasonable delay; no later than 60 days after discovery | 3 |
| Covered entity | Each affected individual | Without unreasonable delay; no later than 60 days after discovery | 2 |
| Covered entity | Prominent media, if more than 500 residents of a state or jurisdiction | Same limit | 2 |
| Covered entity | HHS: 500 or more, at the same time as individuals; fewer than 500, logged and reported within 60 days of year end | As stated | 2 |
Discovery is the first day the breach is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it.2 For a vendor, its employees and agents count the same way.3 An AI vendor whose engineer saw the leak in a log on Monday discovered it on Monday, not when legal was told on Friday.
The business associate’s notice must identify, as far as possible, each affected individual and include the other information the covered entity needs for its own notices.3
AI scenarios
These are illustrations, not determinations. Each needs its own assessment.
| Scenario | Likely starting point |
|---|---|
| An AI assistant sends a visit summary to the wrong patient’s portal | Impermissible disclosure; presumed breach; assess the four factors |
| A scribe vendor’s debug logs with transcripts are exposed on a public bucket | Impermissible access by unknown parties; likely breach; vendor’s 60-day clock to notify the provider |
| A model provider (subcontractor) retains prompts longer than the contract allows, without exposure | A contract violation to report; whether it’s a breach needs assessment4 |
| A clinician pastes a note into a public chatbot with no BAA | Disclosure to an entity with no agreement; assess as a likely breach |
| An agent reads a record it had no reason to read, inside the hospital, with no further use | May fit the good-faith workforce exclusion if the access was within authority; assess1 |
Two of these involve the AI supply chain. The vendor’s subcontractors (cloud host, model provider) are business associates too5, and the business associate contract must require reporting of uses or disclosures the contract doesn’t allow, including breaches.4
What to agree with AI vendors in advance
- A shorter notice window than the 60-day maximum, with the information you need for your own notices.3
- Named subcontractors, each bound to report to the vendor quickly.4
- Encryption at rest and in transit, so a leak is less likely to involve unsecured PHI.1
- Logs of what the tool sent and to whom, detailed enough to answer factor 3: was it actually viewed?
- A contact and a drill: run one tabletop exercise with the vendor before go-live.
Our incident response runbook covers the first hours, and the BAA post covers the contract.
Questions people ask
How long does an AI vendor have to report a breach to a hospital?
No later than 60 calendar days after discovery, and without unreasonable delay.3 Contracts often set less.
Is every AI mistake with PHI a breach?
No. It’s presumed to be one if PHI was used or disclosed impermissibly, unless an exclusion applies or a four-factor assessment shows low probability of compromise.1
When must the media be told?
When a breach of unsecured PHI involves more than 500 residents of a state or jurisdiction.2
For records that help answer “who saw what” quickly, see our healthcare page and the provenance spec. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.