Skip subpage navigation
What is a Breach?
According to the Department of Defense, a breach of personal information occurs when the information is lost, disclosed to, accessed by, or potentially exposed to unauthorized individuals, or compromised in a way where the subjects of the information are negatively affected.
Breach Reporting
The Defense Health Agency Privacy and Civil Liberties Office coordinates breach reporting within the Military Health System. Email us if you have questions about breaches or breach reporting within the MHS.
Guidance tools for breach reporting:
You also may be interested in...
Policy
Aug 2, 2022
The Health Information Technology for Economic and Clinical Health Act, abbreviated the HITECH Act, was enacted under Title XIII of the American Recovery and Reinvestment Act of 2009.
- Identification #: N/A
- Type: Guideline
Policy
Mar 6, 2020
This issuance establishes policy, assigns responsibilities, and prescribes procedures for CUI throughout the DOD in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections 252.204-7008 and 252.204-7012. It also establishes the ...
- Identification #: DODI 5200.48
- Type: Instruction
Policy
Mar 13, 2019
This issuance, in accordance with the authority in DOD Directive 5124.02, establishes policy and assigns responsibilities for DOD compliance with federal law governing health information privacy and breach of privacy; integrating health information privacy and breach compliance with general information privacy and security requirements in accordance ...
- Identification #: DODI 6025.18
- Type: Instruction
Form/Template
Jan 1, 2019
This DD2959 form should be filled out when a breach concerning personally identifiable information occurs.
Form/Template
Nov 27, 2018
.PDF |
151.40 KB
This document outlines the DOD reporting and notification requirements for breaches.
DHA Publication
May 24, 2018
.PDF |
396.51 KB
Establishes DHA's procedures for taking disciplinary and adverse actions.
- Identification #: 029
- Type: DHA-AI
Policy
Aug 12, 2015
This instruction establishes policy and assigns responsibilities for security of individually identifiable health information created, received, maintained, or transmitted in electronic form (referred to in this instruction as “electronic protected health information (ePHI)”).
- Identification #: DoD Instruction 8580.02
- Type: Instruction
Form/Template
Jun 6, 2014
.PDF |
163.93 KB
This template is used to track plans of action and milestones regarding potential breaches.
Fact Sheet
May 5, 2014
.PDF |
153.97 KB
An Information Paper that tells what phishing is, how to respond to phishing attacks, and steps to take to avoid becoming a victim of phishing scams.
Fact Sheet
May 5, 2014
.PDF |
162.19 KB
An Information Paper that explains what malicious code is, including the various types, the proper response to a malicious code attack, and steps to take to avoid receiving malicious code on a computer system.
Fact Sheet
May 5, 2014
.PDF |
154.18 KB
An Information Paper that defines social networking, details the Department of Defense's position on this topic, and discusses the responsible use of social networking and Internet-based capabilities.
Policy
Nov 17, 2010
.PDF |
436.31 KB
This Memorandum updates guidelines in Military Health System Chief Information Officer memorandum “Updated Guidelines on Protection of Sensitive Information in Electronic Mail” of
September 19, 2008.
- Identification #: N/A
- Type: Memorandum
Policy
Apr 28, 2010
.PDF |
253.66 KB
This Memorandum outlines the procedures for the Services for reporting a breach as defined by the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009.
- Identification #: N/A
- Type: Memorandum
Policy
Apr 13, 2010
.PDF |
118.49 KB
This Memorandum outlines the procedures for Contractors for reporting a breach as defined by the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009.
- Identification #: N/A
- Type: Memorandum
Policy
Jun 5, 2009
.PDF |
2.29 MB
In accordance with the policies outlined in this Memorandum, a risk assessment must be conducted for every breach to determine whether notification to affected individuals is necessary.
- Identification #: N/A
- Type: Memorandum
You are leaving Health.mil
The appearance of hyperlinks does not constitute endorsement by the Department of Defense of non-U.S. Government sites or the information, products, or services contained therein. Although the Defense Health Agency may or may not use these sites as additional distribution channels for Department of Defense information, it does not exercise editorial control over all of the information that you may find at these locations. Such links are provided consistent with the stated purpose of this website.
You are leaving Health.mil
View the external links disclaimer.
Last Updated: July 21, 2023