HIPAA breach log for a ride company: each incident, the four-factor test, and the yearly report to HHS

What does a breach log have to prove?

The log must prove, for every privacy incident, either that each required notice went out or that the incident was not a breach. Under 45 CFR 164.414, a covered entity or business associate carries that burden. HHS says to keep the evidence for the “not a breach” side too: the risk assessment showing a low probability of compromise, or the exception that applied (HHS Breach Notification Rule). Who must be told, and by when, is in HIPAA for NEMT companies.

One log does three jobs:

• A record of every incident. Log the misdirected text, the lost manifest, and the wrong rider’s details sent to a facility, whether or not they turn out to be breaches. Security incidents, which include attempted unauthorized access, must also be documented with their outcomes (164.308(a)(6), 164.304). A column for the incident type lets one log hold both.
• A record of each decision. The exception relied on, or the four-factor assessment, written so a reviewer can follow it.
• The source of the yearly HHS report. A covered entity keeps a log of breaches affecting fewer than 500 people and reports them within 60 days after the end of the calendar year (164.408(c)).

The written procedure for reporting and deciding belongs in your HIPAA policy. This page is the log that procedure fills in, and the breach letter template covers the notices.

The log

Keep Part A as one running list for the year. Start a copy of Parts B to D for every row in Part A, even when the incident turns out to be nothing.

Part A: Running log (one row per incident)

Decision codes: P permitted use or disclosure, S secured (encrypted or destroyed), E1, E2, or E3 exception, L low probability shown by assessment, N notices sent, I incident only, no PHI involved.

Part B: Incident record

The first row of Part B starts the clock. It runs from the first day any workforce member or agent, other than the person responsible, knows of the incident or would know of it by looking with reasonable care (164.404(a)(2)). A prompt investigation that finds there was no breach ends the matter. HHS’s own example is a laptop reported stolen that turns up the next day in another office of the same company (74 FR 42749 to 42750), so write the result down and close the row.

Part C: The decision

Work through the steps in order and stop when one settles it.

1. Was it a use or disclosure the Privacy Rule does not permit? If not, record why and close.
2. Was the information unsecured? Electronic information encrypted as HHS guidance describes, with the key not breached, is secured, and so is paper that was shredded or otherwise destroyed so it cannot be read or rebuilt. Record how it was secured (74 FR 42740).
3. Does one of the three exceptions fit? Write down which one and the facts that support it:
   • E1. A workforce member or person acting under the company’s authority opened or used information unintentionally, in good faith and within the scope of their authority, and passed it no further.
   • E2. A person authorized to access rider information at the company passed it by mistake to another authorized person at the same company, and it went no further. The same holds for two people at the same business associate.
   • E3. You have a good faith belief that the person who got it could not reasonably have kept it.
4. If no exception fits, run the four factors in the worksheet below. Without a low probability of compromise, the incident is a breach.
5. Decide and sign. Name who decided and the date.

Overall conclusion (all four weighed together):

Decided by and date:

Part D: Notices and fixes

How to decide the four factors, one at a time

Each factor asks something specific, and HHS’s explanation of the rule gives examples (78 FR 5642 to 5643). The text below turns them into questions a dispatcher can answer.

• What and how much. Sensitive information raises the probability. HHS names Social Security and card numbers, and detailed clinical information such as diagnosis, medications, and test results, and warns that many kinds of health information are sensitive, not only the obvious ones. A rider’s name, address, and the clinic they visit tells a reader about their care. A first name and a pickup time may not identify anyone. If there are few direct identifiers, ask whether the recipient could work out who the person is from other information.
• Who got it. A recipient who must protect the information in a similar way, such as a HIPAA-covered clinic or a federal agency under the Privacy Act, points toward a lower probability. HHS’s contrast is a diagnosis list sent to an employer, who may match dates to absences from work.
• Seen or only exposed. HHS says a stolen laptop that is recovered, and a forensic review shows nobody opened the information, can support the finding that it was not acquired. A letter opened by the wrong person is different: they read it enough to know it was misdirected.
• How far it is contained. Getting the recipient’s assurance that the information will not be used or shared, through a confidentiality agreement or similar means, or that it was destroyed, counts. HHS adds that assurances from an employee, an affiliated business, a business associate, or another covered entity may be relied on, while assurances from some other third parties may not be enough.

HHS expects the assessment to be thorough, completed in good faith, and the conclusion reasonable. If it does not show a low probability of compromise, notification is required (78 FR 5643). HHS also says you have discretion to skip the assessment and send the notices. If you take that route, log the incident as N and note that no assessment was done.

Four examples and the route each takes

These are invented incidents built on situations HHS discusses. The route is the decision code the log would show.

• A wrong-clinic fax. A trip sheet goes to the wrong physician office, which phones the same day to say it received it in error and destroyed it. No exception fits, but HHS says a company may show a low probability after the assessment, since the recipient reported the error and destroyed the fax. Route: L, with the four answers written down.
• A manifest in the mail. A trip list mailed to a rider’s old address comes back unopened. HHS says this can fall under the exception for information the recipient could not reasonably have kept. Route: E3. If the envelope never came back, or the recipient opened it and called, it needs the four factors.
• A trip sheet handed to the wrong rider. The driver realizes at once and takes it back before the rider reads it. HHS’s own example is a nurse who hands one patient another’s discharge papers and recovers them quickly. Route: E3, if you can reasonably conclude the rider could not have read or kept it.
• A phone taken from a van, no lock. Nobody can show the data was never opened, and the phone is gone. Route: N, with the notices dated and filed.

What goes to HHS each year

Breaches that touch fewer than 500 people are reported to HHS once a year: the deadline is 60 days after the calendar year in which you discovered them ends. For discoveries in 2026, that is March 1, 2027. You may report as soon as you discover one. HHS asks for a separate notice for each incident, and allows several to be submitted on the same date (HHS, content reviewed February 13, 2026). Breaches of 500 or more people go on a different clock, with the rider letters, and the breach letter template covers it.

The online form asks for facts the log should already hold. HHS’s sample of the portal’s questions lists these screens. Copy from the log instead of retyping from memory:

The form’s attestation text says that for breaches affecting more than 500 people, some of the answers are posted on the HHS website, so write the description for a stranger. HHS’s sample of the questions dates from 2017, so check the live portal when you file.

Part E: Yearly HHS filing record

Keeping the log six years

Keep the required documentation six years, counted from the day it was created or the last day it was in effect, whichever comes later (164.530(j)). For a covered entity that includes the log, each assessment, the exception relied on, copies of every letter, and proof of filing. The Security Rule sets the same six years for its documents, including security incident records (164.316).

Close each year’s log on its own page, sign it, and file it with the rest of the HIPAA records on your record retention schedule. Put the HHS filing date on your compliance calendar, and the broker clocks beside each incident row.

Pulling the rider list in HealthRide

When an incident involves a day’s manifest or trip list, the list of people affected comes from the trip record. The trip log in HealthRide’s reports exports to a spreadsheet or a print-ready PDF and shows who was scheduled that day. What each person on the team can see depends on their role, and HealthRide records every change.