Under HIPAA, in what situation must you notify a patient that their records were breached?

Correct answer: B. Office computers are broken into (unencrypted PHI exposed)

• A. Physical destruction of records without unauthorized access/disclosure to a third party does not constitute a reportable HIPAA breach in the traditional sense (no PHI was disclosed to an unauthorized party).
• B. Correct. An unauthorized break-in exposing unencrypted protected health information (PHI) constitutes a reportable breach requiring patient notification under HIPAA.
• C. A request for records by another treating provider for treatment purposes is an authorized use/disclosure and not a breach.

Note: HIPAA Breach Notification Reference: Stolen unencrypted laptop → YES, report | Encrypted stolen data → NO | Misdirected email with PHI → YES | Authorized staff viewing info for job duties → NO.