The Four-Factor Breach Risk Assessment

The four-factor assessment is where the clinic explains why it concluded that PHI was or was not compromised.

The four factors

Teams typically analyze the nature of the PHI, who used or received it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated.

What strong documentation looks like

Each factor should cite facts from the incident record: log evidence, email traces, device status, recipient identity, containment actions, and timing. The reasoning should be specific enough that another reviewer can follow how the conclusion was reached.

What weak documentation looks like

Weak assessments rely on phrases like “unlikely to have been viewed” without recording why. They also skip mitigation detail, which is often where the strongest evidence actually lives.