# HIPAA 164.402(a) — Definitions: Breach - Risk Assessment

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_hipaa_164402a_bd22f085ca-hipaa-164402a-definitions-breach-risk-assessment
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [Breach Notification Rule](https://support.icompaas.com/support/solutions/folders/f_gen_62000039493_breachnotificationrule)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

HIPAA · Control 164.402(a) · Priority: medium · Component: Breach Notification Rule

### What this control covers

Definitions: Breach - Risk Assessment. Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part which compromises the security or privacy of the PHI. (2) Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors: (i) The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; (ii) The unauthorized person who used the PHI or to whom the disclosure was made; (iii) Whether the PHI was actually acquired or viewed; and (iv) The extent to which the risk to the PHI has been mitigated.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policy or standard documents the safeguard. Focus: Definitions: Breach - Risk Assessment.

### Quick checklist

-   Security — Security / Management
-   Business — Security / Management
-   Person — Security / Management
-   Policy — Security / Management
-   Definitions: — Security / Management
-   Notification — Security / Management

### Related articles on this site

-   [Acquisition Risk Management](https://support.icompaas.com/support/solutions/articles/62000225148-acquisition-risk-management)
-   [Ensure to have backup access by someone on the team - could be part of "has retention" policy](https://support.icompaas.com/support/solutions/articles/62000229661-ensure-to-have-backup-access-by-someone-on-the-team-could-be-part-of-has-retention-policy)
-   [Ensure Security Groups do not allow unrestricted ingress access to any port](https://support.icompaas.com/support/solutions/articles/62000127014-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-any-port)
-   [Ensure Security Groups do not allow unrestricted ingress access to Oracle Ports 1521 or 2483](https://support.icompaas.com/support/solutions/articles/62000127015-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-oracle-ports-1521-or-2483)

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.