HIPAA Breach Notification
Timelines & Requirements

A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Breaches affecting 500 or more individuals must also be reported to the HHS Secretary without unreasonable delay and within 60 days, and to prominent media in the affected area. Breaches affecting fewer than 500 individuals are logged and reported to HHS in an annual submission. The rule is enforced by the HHS Office for Civil Rights (https://www.hhs.gov/hipaa).

A breach is an impermissible use or disclosure of unsecured PHI that compromises its security or privacy. The rule presumes any impermissible use or disclosure is a breach unless the entity demonstrates, through a four-factor risk assessment, a low probability that the PHI was compromised. PHI that is properly encrypted to HHS standards is "secured," so its loss generally does not trigger breach notification.

To rebut the presumption of a breach, an entity evaluates four factors: (1) the nature and extent of the PHI involved, including identifiers and likelihood of re-identification; (2) the unauthorized person who used or received the PHI; (3) whether the PHI was actually acquired or viewed; and (4) the extent to which the risk has been mitigated. If this assessment shows a low probability of compromise, notification may not be required — but the analysis must be documented.

A business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and no later than 60 days after discovery, providing the identities of affected individuals and the information needed for the covered entity to make its own notifications. The Business Associate Agreement typically sets a shorter contractual deadline. The covered entity then handles notification to individuals, HHS, and the media.

Media notification is required when a breach of unsecured PHI affects more than 500 residents of a single state or jurisdiction. In that case the covered entity must notify prominent media outlets serving that area, in addition to notifying the affected individuals and HHS, all within 60 days of discovery. This media-notice threshold is separate from, but aligned with, the 500-individual threshold that triggers immediate HHS reporting.