In a pure mathematical attack, (i.e., lacking any other information to help break a cipher) two factors above all count: 1  Computational power available, i.e., the computing power which can be brought to bear on the problem. 2  Key size, i.e., the size of key used to encrypt a message.
OMB's guidance to agencies requires them to report each PII-related breach to DHS's U.S. Computer Emergency Readiness Team (US-CERT) within 1 hour of discovery. However, complete information from most incidents can take days or months to compile; therefore preparing a meaningful report within 1 hour can be infeasible.
An acquisition, access, use or disclosure of PHI does not constitute a reportable breach unless it violates the Privacy Rule. Violations of the Security Rule or the HIPAA administrative requirements in the absence of a corresponding Privacy Rule violation are not breaches, although they could lead to future breaches. Not all Privacy Rule violations are reportable breaches - that determination will depend on the following two questions.