Data Breach
HIPAA Breach Notification Overview
TL;DR
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media within 60 days of discovering a breach of unsecured PHI. See our complete Breach Notification Rule guide for full coverage of all requirements.
What to do in the first 60 days after a breach: assess, document, notify individuals and HHS, and avoid the mistakes that turn a breach into a penalty.
The HIPAA Breach Notification Rule requires covered entities and business associates to provide notification when unsecured Protected Health Information is breached.
We have published a complete guide to the HIPAA Breach Notification Rule covering the breach definition, four-factor risk assessment, all notification requirements, and deadlines. Read the full guide for complete coverage.
For complete coverage of all Breach Notification Rule requirements see our full guide: Understanding the HIPAA Breach Notification Rule.
Quick reference
Who must notify: Covered entities notify individuals, HHS, and media. Business associates notify the covered entity.
Deadline: 60 days from date of discovery — not from when your investigation concludes.
Presumption: Any impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a four-factor risk assessment demonstrates low probability of compromise.
Threshold for immediate HHS reporting: 500 or more individuals affected.
Threshold for media notification: 500 or more residents of a state or jurisdiction.
For the complete analysis of each requirement including the four-factor assessment, all notification content requirements, business associate obligations, and state law considerations, see our complete Breach Notification Rule guide.
Sources & citations
- 45 CFR §§164.400-414 — Breach Notification RuleOpen
All content verified against official HHS guidance and the Code of Federal Regulations.
Frequently asked questions
Where can I find the complete HIPAA breach notification guide?▾
Related intelligence
Data Breach
Medical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched
6 min read
Data Breach
Mid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents
5 min read
Data Breach
Central Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated
6 min read
Not legal advice. medcomply.ai provides compliance intelligence for educational and operational planning. Consult qualified counsel for legal interpretation.