Lion Cipher Lab

Run a HIPAA Breach Notification four-factor risk assessment and decide who to notify

• GRC / Compliance
• Intermediate
• ~75 min
• Free · no account required

Why it matters

The day after an incident, a healthcare organization faces one high-stakes question: do we have to tell anyone, and if so, whom and how fast? Get it wrong by under-reporting and you have a willful-neglect finding and penalties; get it wrong by over-reporting and you have needlessly alarmed thousands of patients, triggered a media cycle, and burned trust over an event that was never a reportable breach. The HIPAA Breach Notification Rule is the law that governs that exact call, and its heart is a structured four-factor risk assessment that most people have never actually run — they default to…

What you'll learn

• applying the HIPAA Breach Notification Rule (45 CFR 164.402-408), not the Security Rule
• running the four-factor risk assessment of 164.402(2) on a real incident
• applying the encryption safe harbor (unsecured vs secured PHI)
• applying the three 164.402(1) exceptions that mean an event is not a breach
• deciding notification scope: individuals, media, and HHS, and the 60-day clock
• splitting breaches at the 500-individual threshold (immediate vs annual HHS reporting)
• documenting a defensible 'low probability of compromise' rationale when you decide NOT to notify

Steps in this lab

1. First: this is NOT the Security Rule risk analysis
2. The two gates BEFORE the four factors — safe harbor and the three exceptions
3. The four factors of 164.402(2) — what you actually score
4. Meet the eight incidents
5. Build the worksheet
6. Run it, and read the measured result
7. Why each of the three 'do-not-notify' calls is defensible (and where it could flip)
8. The honest limits — judgment, the high bar, and state law in parallel

Open the full interactive lab →