A Breach as Defined by the DoW Is Broader Than a HIPAA Breach or Breach Defined by HHS: The Three-Contract Trap Explained

A breach as defined by the DoW is broader than a HIPAA breach or breach defined by HHS because the Department of War's contract clauses pull in any unauthorized access to controlled unclassified information, including unsuccessful attacks that HIPAA never counts. Under 45 CFR §164.402, a HIPAA breach needs unsecured protected health information plus a risk assessment that fails to prove low probability of compromise. A DoW breach report can trigger on an incident where nothing was exfiltrated and no patient data existed at all.

The Three Definitions Side by Side: HIPAA, HHS Guidance, and DoW Contract Language

Start with the statutory anchor. HIPAA's breach definition lives at 45 CFR §164.402 and covers acquisition, access, use, or disclosure of protected health information in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI. The definition carries three exclusions: unintentional access by an employee acting in good faith within scope, inadvertent disclosure between two authorized persons at the same covered entity, and a disclosure where the covered entity has a good-faith belief the recipient could not retain the information.

HHS guidance adds a presumption. Under the HITECH Act's Section 13402, an impermissible use or disclosure is presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised, measured through a four-factor risk assessment: the nature and extent of the PHI involved, the unauthorized person who used or received it, whether the PHI was actually acquired or viewed, and the extent of risk mitigation.

DoW language is a different animal entirely. The DFARS 252.204-7012 clause — Safeguarding Covered Defense Information and Cyber Incident Reporting — defines a "cyber incident" as actions taken through the use of computer networks that result in an actual or potentially adverse effect on an information system or the information residing therein. That "potentially adverse effect" phrasing is the hinge. A port scan that touches nothing still qualifies. A malware infection quarantined before execution still qualifies. A misconfigured cloud bucket that logged no access still qualifies.

The table shows the asymmetry. HIPAA gives a covered entity three ways to argue an incident is not a breach before reporting. The DoW framework gives a contractor one path: report within 72 hours and let the government decide.

Why the DoW Definition Captures Events HIPAA Excludes

Take a scenario a defense contractor actually faces: a subcontractor's helpdesk technician opens a phishing link on a workstation that holds a personnel file with home addresses for 40 cleared employees and also a CAD drawing marked CUI. The phishing page captures credentials but no session is established before endpoint detection quarantines the browser. Under HIPAA, if the 40 employees are not patients and the file contains no diagnosis, treatment, or payment data tied to a health plan, the incident is outside HIPAA entirely — no breach, no notification, no log entry in OCR's portal.

Under DoW contract terms, that same incident is a cyber incident. The CAD drawing is covered defense information. The phishing attempt is an action taken through a computer network. The adverse effect on the information system is potential if not actual. The contractor reports within 72 hours to the DoW via the DIBCAC portal and separately notifies the contracting officer. Nothing was stolen. Nothing was viewed. The report is still due.

HIPAA's three exclusions have no analogue in DFARS. The good-faith employee access exception at §164.402(1)(i) does not translate because the DoW definition does not care about intent. An employee who mistakenly emails a CUI document to a personal account becomes a reportable incident regardless of good faith. That is the practical gap most compliance teams miss when they map HIPAA procedures onto DoD contracts.

The consequences differ too. HIPAA breach notification triggers HHS Office for Civil Rights enforcement, state attorneys general under 45 CFR §160.300, and in some states a private right of action. DoW non-reporting lands in contract disputes, suspension and debarment referrals, and withholding of award fees. The penalties are contractual rather than regulatory, which makes them harder to see in the compliance budget.

The 72-Hour DoW Clock Versus HIPAA's 60-Day Window

Timing decides which framework bites first. HIPAA counts 60 calendar days from discovery under 45 CFR §164.404(b), and for breaches affecting 500 or more individuals the notice to HHS must be contemporaneous with individual notice. For smaller breaches, the annual log filed within 60 days of the calendar year's end applies. The clock starts at discovery — the first day the incident is known or should reasonably have been known.

DFARS 252.204-7012 requires rapid reporting — DoW has traditionally required notification within 72 hours of discovery of a cyber incident. That is roughly 1.4% of the HIPAA window. If a contractor discovers an incident on Monday morning, the DoW report is due Thursday morning, well before the HIPAA risk assessment has even been drafted in most shops.

The failure case is common: a defense contractor with a HIPAA-covered health plan for its own employees treats an incident as a HIPAA matter, launches the four-factor assessment, convenes privacy counsel, and drafts the OCR submission at day 45. The DoW portal deadline slipped by day 3 without anyone noticing. Contracting officer notification happens on day 46, and the resulting cure notice cites late reporting under DFARS 252.204-7012 paragraph (c). The HIPAA analysis was complete and competent. It was simply the wrong clock.

A second timing trap involves the subcontractor flow-down. DFARS 252.204-7012(e) requires the prime contractor to flow the clause to subcontractors whose work involves covered defense information. When a subcontractor reports to the prime, the prime has 72 hours from its own discovery. That clock may already have been running for 40 hours inside the subcontractor before the notification arrives. Two-tier defense supply chains routinely miss the 72-hour mark for that reason alone.

CUI Scope: What Counts Beyond Protected Health Information

The DoW framework's scope is broader than HIPAA's not because it names more data types but because it does not need to name a data type at all. DFARS 252.204-7012 references "covered defense information," which the DoD Cyber Crime Center defines as unclassified information that is provided to the contractor by or on behalf of DoW, or collected, developed, received, transmitted, used, or stored in support of the performance of a contract, and covered by the controls in NIST SP 800-171. The 800-171 controls cover 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

A HIPAA breach requires protected health information, defined at 45 CFR §160.103 as individually identifiable health information transmitted or maintained in electronic or any other form. If a defense contractor's laptop holds no health data — typical for a machining shop making aircraft brackets — the HIPAA framework never activates. The DFARS framework does, because the CAD files, the inspection procedures, and the engineering drawings are covered defense information.

The edge case that bites: a defense contractor runs a self-insured health plan for its 300 employees. The plan is a separate HIPAA covered entity. If the CAD workstation and the health plan administrator's laptop share a file server, a ransomware event on that server produces two obligations at once. The HIPAA analysis goes one direction and the DFARS analysis goes another. Neither route cancels the other.

Controlled unclassified information also appears in CMMC scoping. As of the CMMC Program final rule published in October 2024, Level 2 requires 110 NIST SP 800-171 controls and an annual assessment, and Level 3 requires NIST SP 800-172 controls with government-led assessment. The CMMC scope is driven by whether CUI is handled, and a HIPAA-scoped network inside a defense contractor is almost always inside the CMMC boundary as well if any CUI touches the same system. The overlap is where double-reporting and double-auditing costs land.

What Actually Triggers the Reporting Obligation

Read DFARS 252.204-7012 paragraph (c) carefully. The obligation is not "report any data loss." The obligation is to report a cyber incident that affects covered defense information or the contractor's ability to perform the contract, and to submit malicious software to the DoW Cyber Crime Center. The definition of cyber incident sweeps in attempted attacks because the adverse effect can be "potentially" adverse.

That language makes a policy question for every contractor: how close to an unsuccessful attack do you report? Common practice across the defense industrial base is to report any intrusion attempt that satisfies all three tests — it was network-borne, it touched or attempted to touch a system handling covered defense information, and there was a potential adverse effect. A million failed login attempts from a botnet is a borderline case; HHS would never see it as a HIPAA breach, and many contractors successfully report it to DoW only as a cybersecurity incident log entry rather than a formal cyber incident report, with the rationale documented.

The cleanest operational rule is: if an analyst cannot state with confidence that no CUI system was in scope and no adverse effect was possible, report. The cost of over-reporting is a thin document set and a phone call. The cost of under-reporting is a contract cure notice, which costs more in legal fees than the entire annual security budget of most small defense manufacturers.

Watch the interaction with other incident frameworks. NIST SP 800-61r3, published in April 2025, is the current incident handling guide and the reference most DoW contractors use to structure the 72-hour report. That guide's "incident vs. event" distinction does not match DFARS language — an event under NIST is still frequently a reportable incident under DFARS. Most compliance teams adopt the DFARS definition as the reporting boundary and use NIST language only for the internal playbook.

A Worked Cost of Getting the Definition Wrong

Assume a 60-person defense electronics subcontractor holding DFARS 252.204-7012 and a HIPAA-covered self-insured plan. A malware incident affects one server with both design files marked CUI and a benefits administration file with 80 employees' PHI. The team treats it as a HIPAA-only matter: risk assessment, no low-probability determination reached, individual notices mailed at 60 days, HHS log filed. The CUI side is not reported to DoW because the internal memo says "no data exfiltration confirmed."

The arithmetic on the failure path: one contracting officer cure notice, 30 hours of legal response at an assumed $350/hour (a reasonable planning rate; verify against your own counsel's schedule), one suspension-and-debarment inquiry response, 60 hours of replatforming and re-scoping the CUI boundary, and a delayed option exercise. Using those assumptions, the correction cost lands at roughly $24,000 to $36,000 in labor alone before any award-fee impact — and any actual award-fee reduction on a $5M contract can quickly dwarf that. HIPAA side costs, by contrast, may be zero if the risk assessment clears the breach or very modest if the number of affected individuals is under 500.

That cost comparison gets at why the DoW definition matters financially. HIPAA default enforcement posture for a small breach with documented mitigation is a low-dollar resolution agreement. DFARS default posture for a missed 72-hour report is a compliance issue that travels with every future contract.

Overlap Zones Where Both Apply — HIPAA Covered Entities on DoW Contracts

Most of the practical confusion sits in the overlap. A defense contractor that is a HIPAA covered entity (self-insured health plan, on-site clinic, health-related research) faces two reporting regimes. If an incident touches both PHI and CUI — a shared file server, a shared email tenant, a merged M&A IT environment — the incident is reportable under both. HIPAA through HHS at 60 days for 500+ individuals or contemporaneously for larger incidents, and DFARS through the DIBCAC portal within 72 hours.

Neither report satisfies the other. HHS Office for Civil Rights does not forward breach reports to DoW, and the DIBCAC portal does not feed the OCR breach portal. Contractors with dual obligations need a single incident intake that captures both scopes and files two reports from one fact set. Skipping one report is the standard finding in DIBCAC assessments and the standard inference in an OCR investigation.

The unclassified CUI rule, 32 CFR Part 2002, issued by the Information Security Oversight Office, governs marking and safeguarding of CUI government-wide. The DoW framework inherits that marking system. A HIPAA breach notice does not touch CUI marking because the data types differ. A CUI spill that includes PHI would need both a CUI spill report and a HIPAA breach assessment, and only one of those is a natural reflex for a privacy officer trained on HIPAA.

Control the overlap with a single register: one incident ID, two reporting columns, two clocks. This is the operationally correct approach and one that CMMC assessors routinely ask to see when the contractor handles both PHI and CUI.

Building an Incident Register That Satisfies All Three

The register should have one column for HIPAA status, one for HHS guidance status, and one for DoW status, with due dates calculated from the same discovery timestamp. That discovery timestamp is the single most important line item. HIPAA counts from discovery under §164.404(b). DFARS counts from discovery. The two definitions of "when did we discover" should match or one report will challenge the other.

Track the four-factor HIPAA risk assessment and the DoW cyber incident report as separate deliverables working off one fact base. If a fact is not yet known at hour 24, the DoW report should be filed with the knowns and amended when the HIPAA analysis completes. The DFARS write-up accepts updates. Late filing does not.

Document the "why we did not report" decisions with equal care to the "why we reported" decisions. If an analyst declines to file a DoW report because no CUI system was touched, that determination needs a named reviewer, the version of the CUI scoping document, and a date. Two years later in a DIBCAC review, that memo is the difference between a defensible position and a finding.

One more gap that HIPAA does not create but DFARS does: the DFARS clause requires flow-down to subcontractors. Prime contractors need to monitor their subs' 72-hour reports to compute their own clock. Many repeat incidents in the defense supply chain come from a prime that received the sub report at hour 65 and could not file before the 72-hour mark.

Common Misconceptions That Cost Defense Contractors Real Money

Three misconceptions recur. First, the belief that DFARS reporting only applies to incidents involving classified data. It does not. The clause expressly covers covered defense information, which is unclassified. Classified incidents go through different channels entirely, and conflating them misses the DFARS obligation.

Second, the belief that a HIPAA risk assessment proving low probability closes the incident under all frameworks. It does not. The four-factor low-probability test at §164.402 is a HIPAA-only animal. Under DFARS, the trigger is the potentially adverse effect, and proving the PHI wasn't compromised says nothing about whether a CUI system was touched.

Third, the belief that a DoW report replaces the need to notify individuals. It does not. If PHI was involved and HIPAA obligations attach, individual notice still goes to the individuals whose PHI was compromised, and the DoW report does not speak to that population at all. The two notices serve different audiences and neither waives the other.

One lesser-known sanction: under FAR 52.204-21 the basic safeguarding clause for federal contractors applies to all federal contracts, not just DoD ones. Contractors who think their HIPAA-covered status insulates them from federal cybersecurity clauses should check the clause flow-down to their commercial item contracts as well.

FAQ

Does a failed phishing attempt count as a HIPAA breach?

No, that outcome is rare under HIPAA — a phishing attempt where no PHI was viewed, accessed, or disclosed usually fails the compromise test — but it can count as a DoW cyber incident. The reason is that DFARS 252.204-7012's definition includes "potentially adverse effect" on a covered system, and a phishing attempt against a user with access to CUI satisfies that phrase even if the click never landed. Report it to the DoW portal within 72 hours; treat the HIPAA side as a separate question analyzed on its own facts.

What is the difference between an HHS breach and a DoW cyber incident?

The HHS breach framework requires protected health information, an impermissible use or disclosure, and a failed low-probability assessment under 45 CFR §164.402. The DoW cyber incident framework requires a network-borne event with an actual or potentially adverse effect on a system handling covered defense information or affecting contract performance. Neither element of the HIPAA definition is necessary for the DoW definition to apply, which is why they are separate obligations rather than interchangeable ones.

Do I have to notify HHS if I already reported the incident to DoW?

Yes, if HIPAA obligations attach. DFARS reporting is a contract requirement, not an OCR submission, and no agency forwards one to the other. A 500+ individual breach still requires contemporaneous HHS and individual notice under 45 CFR §164.404 and §164.408 regardless of whether the DIBCAC portal received a report. File both and keep one incident register that carries both due dates.

Can I avoid DoW reporting if the data was encrypted and never accessed?

It depends on the CUI scope, not on the encryption alone. DFARS does not replicate HIPAA's "secured PHI" carve-out, and the clause can apply if any covered defense information on the affected system was in scope and the incident could have had an adverse effect. Encryption evidence is relevant, but it is not the sole test. Document the scope determination with the CUI marking on the affected files.

What is the fine for missing the 72-hour DoW report?

There is no fixed fine — DFARS penalties run through contract remedies, not a penalty schedule. Possible outcomes include a cure notice, withholding of award fees, a suspension and debarment referral, or a finding in a CMMC assessment that affects contract eligibility. The dollar exposure varies by contract value and agency posture, so contractors should budget legal and remediation time rather than a fixed fine.

Does the DoW definition apply if my company is small and not a defense prime?

Yes, if DFARS 252.204-7012 flows down to you. The clause requires primes to flow it to subcontractors whose work involves covered defense information, so any tier can be inside the 72-hour obligation. Small subcontractors should confirm the flow-down language in their purchase orders rather than assume the prime carries the reporting burden alone, because the DoW clause rarely absolves the sub.

Is the DFARS 72-hour clock really stricter than HIPAA's 60-day clock in practice?

Yes, in practical terms. The 72-hour clock requires a nearly immediate decision on scope with far less time to build a risk assessment. Most HIPAA responses use a 30-day investigation window before notice drafting; the DoW framework has no such cushion. Contractors need a pre-approved incident playbook with a documented reporting decision template so the 72-hour filing can happen even if the facts are still emerging.

What if the affected system contains both PHI and CUI — do I file two reports?

Yes. Two reports with two review owners working off one fact set. The HIPAA report goes to HHS through the Office for Civil Rights breach portal, and the DoW report goes through the DIBCAC incident reporting process. Neither report closes the other, and a single-register approach with one discovery timestamp is the most defensible arrangement if either agency asks for your records.

This article is general educational information about breach definitions under HIPAA, HHS guidance, and DoW contract terms. It is not legal advice, a compliance determination, or a substitute for review by a licensed attorney or qualified compliance professional familiar with your contracts, agency relationships, and jurisdiction. Contractors handling PHI, CUI, or both should confirm obligations with their contracting officer, privacy officer, and legal counsel before making reporting decisions.