HITECH Subtitle D - Breach Notification + Business Associate (BA) direct liability. BREACH NOTIFICATION RULE (Section 17932; 45 CFR Part 164 Subpart D, Sections 164.400-414): covered entities + BAs must provide notification following discovery of a breach of UNSECURED PHI (PHI not rendered unusable/unreadable/indecipherable to unauthorized individuals via encryption per NIST or destruction). BREACH DEFINITION (45 CFR 164.402): acquisition + access + use + disclosure of PHI not permitted under HIPAA Privacy Rule which compromises security/privacy; presumed breach unless covered entity demonstrates LOW PROBABILITY OF COMPROMISE via 4-FACTOR RISK ASSESSMENT: (1) nature + extent of PHI + types of identifiers + re-identification risk; (2) unauthorized recipient identity + likelihood of re-disclosure; (3) actual acquisition + viewing of PHI; (4) extent of mitigation. EXCLUSIONS: unintentional access by workforce member + inadvertent disclosure between authorized + unable to retain PHI. NOTIFICATION REQUIREMENTS: (a) INDIVIDUAL NOTIFICATION - within 60 calendar days of discovery + written notice via first-class mail + email if previously authorized + substitute notice if contact information out-of-date for 10+ individuals; (b) MEDIA NOTIFICATION - if breach affects 500+ residents of a state + 60 days + prominent media outlet in state; (c) HHS SECRETARY NOTIFICATION - 500+ breach notice immediately (60 days) + reporting to HHS Wall of Shame (publicly viewable on hhs.gov OCR); 500-or-less annual report to HHS within 60 days after year-end; (d) BA NOTIFICATION TO COVERED ENTITY - 60 days + BA-CE coordination per Business Associate Agreement (BAA). BUSINESS ASSOCIATE DIRECT LIABILITY (Section 17934): post-HITECH BAs are DIRECTLY SUBJECT to HIPAA Security Rule + key Privacy Rule provisions + civil + criminal sanctions; pre-HITECH BAs were only contractually liable; subcontractor BAs (downstream contractors of BAs handling PHI) also subject + must execute BAA agreements with upstream BAs. BAA REQUIREMENTS: written agreement specifying permitted uses + disclosures + safeguards + reporting + termination + subcontractor flow-down + return/destruction of PHI. WALL OF SHAME: HHS OCR publishes breaches affecting 500+ individuals + searchable database + accountability mechanism.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.