--- title: "Privacy Guidance: What is \"Mitigation\" under the HIPAA Privacy Rule?" description: Compliancy Group Help Center --- [Skip to content](https://knowledge.compliancygroup.com/home/support/solutions/articles/48001249392-what-is-mitigation-under-the-hipaa-privacy-rule-#main-content) English - United States Show submenu for translations [Submit a Ticket](https://knowledge.compliancygroup.com/home/kb-tickets/new?hsLang=en-us) [Go To Customer Portal](https://help.compliancygroup.com/home?hsLang=en-us) ![Compliancy Group](https://knowledge.compliancygroup.com/hs-fs/hubfs/Compliancy%20Group%20Logo%20Full%20RBG-sized.png?width=300&height=54&name=Compliancy%20Group%20Logo%20Full%20RBG-sized.png) Open main navigation Close main navigation - English - United States Show submenu for translations - [Submit a Ticket](https://knowledge.compliancygroup.com/home/kb-tickets/new) - [Go To Customer Portal](https://help.compliancygroup.com/home) How can we help you? - There are no suggestions because the search field is empty. 1. [Help Center](https://knowledge.compliancygroup.com/home?hsLang=en-us) 2. [Healthcare Compliance](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us) 3. [Privacy](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#privacy) # Privacy Guidance: What is "Mitigation" under the HIPAA Privacy Rule? **DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice; instead, all information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.**   **Introduction** This article discusses the Privacy Rule requirement to mitigate, to the extent practicable, harmful effects of PHI uses and disclosures. **What is the Privacy Rule Mitigation Requirement?** Per the Privacy Rule at [45 CFR 163.530(f)](https://www.ecfr.gov/current/title-45/part-164/section-164.530#p-164.530(f)), a covered entity must mitigate, to the extent practicable, any harmful effect that is known to the covered entity of a use or disclosure of protected health information in violation of its policies and procedures or the requirements of the Privacy Rule by the covered entity or its business associate. As part of this mitigation requirement, covered entities should take measures such as: 1\. Ensuring that mitigation plans are developed, implemented, and applied in accordance with the covered entity's policies and procedures.   2\. In response to a report of or information about a workforce member’s or business associate’s unauthorized use or disclosure of PHI, acting promptly to reduce any known or reasonably anticipated harmful effects from the disclosure.   In an electronic environment, specific mitigation measures [may include](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/healthit/accountability.pdf): 1\. Identifying the cause of the a violation and amending privacy policies and technical procedures, as necessary, to prevent recurrence. 2\. Contacting the network administrator, as well as other potentially affected entities, to try to retrieve or otherwise limit the further distribution of improperly disclosed information. 3\. Notifying individuals of a violation if an individual needs to take self-protective measures to ameliorate or avoid the harm, as in the case of potential identity theft The HIPAA Breach Notification Rule also contains a mitigation requirement. When there has been a breach of unsecured PHI, the required notification to be sent to individuals [must include](https://www.ecfr.gov/current/title-45/part-164/section-164.404#p-164.404(c)(1)) (among other things): 1\. Any steps individuals should take to protect themselves from potential harm resulting from the breach. Individuals may protect themselves through measures such as enrolling in credit monitoring and placing a fraud alert with the three major credit bureaus; monitoring account statements, EOBs, and credit bureau reports closely; contacting their state's Consumer Protection Agency; and, if they have information that their PHI has been compromised, notifying law enforcement to assist in the investigation (this can include contacting and/or filing a report with local law enforcement, the state attorney general office, and the Federal Trade Commission).  2\. A brief description of what a covered entity or business associate is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches.  Measures covered entities and business associates can take to mitigate harm to individuals include  initiating a forensics security investigation; filing a police report; initiating a criminal investigation; imposing appropriate workforce sanctions; addressing operational or technology updates or changs triggered by an incident to improve confidentiality, such as strengthening technology safeguards or administrative policies and procedures; and, if appropriate, cancelling a business associate contract.  - [Getting started](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#main-content) - [Onboarding](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#onboarding) - [Product Overviews](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#product-overviews) - [Workforce](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#main-content) - [Policies](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#policies) - [Settings Module](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#settings-module) - [3rd Party Risk](https://knowledge.compliancygroup.com/home/3rd-party-risk?hsLang=en-us) - [Incident Management](https://knowledge.compliancygroup.com/home/incident-management?hsLang=en-us) - [Risks & Assessments](https://knowledge.compliancygroup.com/home/risks-assessments?hsLang=en-us) - [Healthcare Compliance](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#main-content) - [Privacy](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#privacy) - [Data Security](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#data-security) - [OSHA Workplace Safety](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#osha-workplace-safety) - [Clinical & Quality](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#clinical-quality) - [State Requirements](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#state-requirements) - [Fraud, Waste & Abuse](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#fraud-waste-abuse) - [Compliance Operations](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#compliance-operations) - [Legacy Guard Features](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#main-content) - [Admin - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#admin-legacy) - [Assets - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#assets-legacy) - [Documents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#documents-legacy) - [Incidents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#incidents-legacy) - [My Documents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#my-documents-legacy) - [My Tasks - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#my-tasks-legacy) - [People - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#people-legacy) - [Programs - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#programs-legacy) - [Reports - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#reports-legacy) - [The Dashboard - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#the-dashboard-legacy) - [Training - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#training-legacy) - [Vendors - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#vendors-legacy) - [Account & Billing](https://knowledge.compliancygroup.com/home/account-billing?hsLang=en-us) - [The Guard Support](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#main-content) - [P&P Drafts](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#pp-drafts) - [Settings](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#settings) [![compliancy-group-logo-white](https://knowledge.compliancygroup.com/hs-fs/hubfs/compliancy-group-logo-white.png?width=200&height=37&name=compliancy-group-logo-white.png "compliancy-group-logo-white")](http://compliancy-group.com) Contact Us - [support@compliancygroup.com](mailto:support@compliancygroup.com) Copyright © 2026, Compliancy Group LLC Cookie Settings