If ePHI is encrypted using approved methods and is acquired by an unauthorized person, is it a reportable breach?

• A.No, properly encrypted ePHI is considered unusable and not a breach requiring notification
• B.Yes, always, because acquisition by an unauthorized person is a breach regardless of encryption status
• C.Only if the encryption key is also compromised, in which case the notification duty falls on the key custodian rather than the covered entity
• D.Only if more than 500 records are involved, the threshold at which the breach definition itself begins to apply