Determining whether or not a breach has occurred  entails performing a risk assessment that considers a number of factors. First, the covered entity should consider who impermissibly used or to whom the information was impermissibly disclosed when evaluating the risk of harm to individuals. If the disclosure is to another entity covered by HIPAA, such as the health insurance provider, there may be less risk of harm to the individual, as the recipient is obligated by the HIPAA rules. The reverse is also true, so if the disclosure is to a non-covered entity, the risk is greater. Second, if immediate steps are taken to mitigate the disclosure, such as assurances from the recipient that the information will be destroyed and not further disclosed, then HHS would interpret that the security/privacy of the data has not been compromised and there is no breach.  Also, if the lost data is returned (i.e. a laptop) and an investigation shows records were not accessed, then there has been no breach.  Third, in conducting a risk assessment, the amount and type of data disclosed should be reviewed. If the only disclosure was the name of an individual and the fact that he/she received services from a hospital, there would be a Privacy Rule violation, but the disclosure may not constitute a significant risk of financial or reputational harm. However, if the type of services received is disclosed, then there is a higher likelihood a breach has occurred.

If a limited data set is disclosed (see definitions below) it is still considered a possible breach, unless the date of birth and zip code is also removed.  This is a very narrow exception.  Permissible research activity, as allowed under the Privacy Rule, would not constitute a breach. 

See the Seyfarth Shaw article dated 8/26/09 and titled HIPAA Breach Notification Interim Final Rule which notes that sanctions will not be imposed until Feb. 22, 2010 for failure to comply.