HIPAA Breach Notification Rule

How the HIPAA breach notification rule works

The HIPAA breach notification rule (45 CFR 164.400 to 164.414) requires a covered entity to notify each affected person after a breach of unsecured protected health information, without unreasonable delay and no later than 60 calendar days after discovery ¹. Larger breaches also go to HHS and the media, and a business associate must tell the covered entity about its breaches ¹.

The clock starts at discovery, which is often earlier than practices assume: the first day the breach is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it ¹. If a front desk employee spots a misdirected fax on Monday, the clock starts Monday.

Sixty days is a ceiling, not a target. The rule puts "without unreasonable delay" first ¹, so a practice that has the facts on day 20 and waits until day 59 can still be late. The one built-in pause is a law enforcement request: delay for the period an official states in writing, or up to 30 days on a documented oral request ¹.

Late notice is a violation on its own. In July 2026 OSF Healthcare System paid $552,250 to settle an OCR investigation of a ransomware attack it found in April 2021 and reported in October 2021 ⁵. OCR said OSF potentially violated the rules, including by failing to give timely notice to the 53,907 affected individuals and to HHS ⁵. Penalties follow four culpability tiers, at these amounts after HHS's 2025 inflation adjustment, published January 28, 2026 ⁶:

What counts as a breach: the presumption and the risk assessment

Any use or disclosure of PHI that the Privacy Rule does not permit is presumed to be a breach unless you can show a low probability that the information was compromised ¹. You show that with a written risk assessment that covers at least four factors ¹:

1. The nature and extent of the PHI involved, including the types of identifiers and the chance it could be re-identified.
2. The unauthorized person who used the PHI or received it.
3. Whether the PHI was actually acquired or viewed.
4. How far the risk to the PHI has been mitigated.

HHS says you may also skip the assessment and simply notify ³. Three situations are not breaches at all ¹³:

• Good-faith internal access. A workforce member, acting in good faith and within their authority, unintentionally accesses or uses PHI, and it goes no further.
• Inadvertent internal disclosure. One person authorized to access PHI shares it with another authorized person at the same organization or arrangement, and it goes no further.
• No ability to retain. You believe in good faith that the recipient could not reasonably have kept the PHI.

Ransomware gets no shortcut. HHS says that when ePHI is encrypted by a ransomware attack, a breach has occurred, because the information was acquired ⁸.

The burden of proof is on you: if you decide an incident was not a breach, or that you sent every required notice, you must be able to prove it ¹. Keep the assessment, its facts and the decision for six years ¹⁸, alongside written breach policies and training records ³.

Unsecured PHI and the encryption safe harbor

The notice duties apply only to unsecured PHI: PHI that has not been made unusable, unreadable or indecipherable to unauthorized people by a method HHS specifies ¹. HHS names two methods ⁴:

• Encryption that follows NIST SP 800-111 for data at rest and NIST SP 800-52, 800-77 or 800-113 (or other FIPS 140-2 validated methods) in transit, with keys uncompromised and stored apart from the data.
• Destruction. Paper and film shredded or destroyed so the PHI cannot be read or reconstructed, and electronic media cleared, purged or destroyed under NIST SP 800-88. HHS specifically excludes redaction.

If PHI secured this way is lost or stolen, no notice is required ³, which makes encryption on laptops, phones and backups one of the most useful controls a small practice can have.

The safe harbor depends on the state of the device. HHS says a lost laptop with full disk encryption that was powered off holds no unsecured PHI, but if ransomware reaches it while a user is logged in, the files are decrypted transparently and a breach is presumed ⁸.

Our HIPAA compliance checklist covers how the current Security Rule treats encryption. The January 2025 proposal to update the Security Rule would require encryption at rest and in transit with limited exceptions, but it is still only a proposed rule, and HHS says the current rule remains in effect ⁹¹⁰.

Notice to individuals, HHS and the media

Individuals. Every breach of unsecured PHI needs written notice to each affected person, by first-class mail, or by email if the person agreed to electronic notice ¹. In plain language, it must cover, as far as possible ¹:

• what happened, with the date of the breach and the date you discovered it
• the types of PHI involved, such as Social Security numbers, diagnoses or account numbers
• steps the person should take to protect themselves
• what you are doing to investigate, reduce harm and prevent a repeat
• how to reach you, including a toll-free number, email address, website or postal address

If contact details are missing or out of date for 10 or more people, post a conspicuous notice on your home page for 90 days or run one in major print or broadcast media ¹. Keep a toll-free number active for at least 90 days as well ¹.

HHS. For 500 or more people, notify HHS through its online breach portal at the same time as individuals ¹². For fewer than 500, keep a log and report each breach within 60 days after the end of the calendar year of discovery, or sooner if you prefer ². File a separate report for each incident, and if the count is not final, give an estimate and add an addendum later ².

Media. If more than 500 residents of one state or jurisdiction are affected, notify prominent media outlets serving that area within the same 60 days ¹. HHS notice starts at 500 people in total; media notice starts at more than 500 residents of a single state.

OCR received 663 reports of breaches affecting 500 or more people in 2024 and 74,299 reports of smaller ones, and it opened investigations into all 663 large breaches ⁷.

Business associate breach notification duties

A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery ¹. That includes billing companies, IT providers, cloud backup vendors and any other vendor handling PHI for a practice. The notice must identify each affected person as far as possible and pass on the facts the covered entity needs for its own letters, at once or as they become available ¹.

Three points matter in practice:

• The covered entity still owns the notice. HHS says the covered entity is ultimately responsible for notifying individuals, though it may delegate the work ³. A business associate may also file the HHS report on its behalf ².
• The covered entity's clock may already be running. A breach is discovered when any agent of the covered entity knew of it, with agency decided under federal common law ¹. If your vendor acts as your agent, its discovery date can become yours.
• Sixty days is the legal maximum ¹. The rule does not set a shorter window, but a business associate agreement can add one as a contract term, and a practice with its own 60-day deadline has good reason to ask. Spell out what counts as reportable, who gets the call and what the first report must include.

Our page on HIPAA compliance services covers what an IT provider should sign and deliver.

How state breach laws and the FTC rule fit in

A state breach law may apply on top of HIPAA where it is stricter or adds a step, such as a shorter deadline or notice to the attorney general. Our table of data breach notification laws by state gives each state's rule, and counsel can confirm how it applies to you.

States treat HIPAA entities differently:

• Extra notice to the state. New York accepts HIPAA notice in place of its own notice to residents, but a covered entity that notifies HHS must send the attorney general a copy within five business days ¹¹. Illinois treats HIPAA-compliant entities as compliant, with the same five-business-day attorney general notice ¹².
• Shorter deadlines. New York's general law gives 30 days to notify residents, half of HIPAA's outer limit, though as noted above it accepts HIPAA notice instead ¹¹. Whether a shorter state deadline reaches your PHI depends on that state's exemption, so check its row before you count on 60 days.

Health apps and the FTC. Health apps and personal health record vendors outside HIPAA fall under the FTC's Health Breach Notification Rule instead ¹³. Amendments effective July 29, 2024 confirmed that it covers many health apps and that sharing health data without the user's authorization is a breach even without a hack ¹⁴. Its clocks are close to HIPAA's: individuals within 60 calendar days, the FTC at the same time when 500 or more people are affected, and the media when at least 500 residents of a state are affected ¹³. The FTC's guidance lists civil penalties of up to $53,088 per violation ¹³.

What a small practice should do in the first days

If a breach is happening now, call your cyber insurer's breach hotline first if you have a policy ¹⁵, report the attack to the FBI at ic3.gov ¹⁶, and do not wipe or rebuild systems before evidence is preserved ¹⁷. Our incident response guide covers the first hours.

Then work through the HIPAA steps:

1. Write down the discovery date. Record when anyone in the practice, or any agent acting for it, first knew. Your deadlines run from that day ¹.
2. Contain and mitigate. HIPAA requires mitigation to the extent practicable ¹⁸, and mitigation is one of the four risk factors ¹.
3. Get facts from vendors. If a business associate was involved, ask in writing for the list of affected people and the details your letters need ¹.
4. Run and document the four-factor assessment, or decide to notify without one ³. Check whether the data was encrypted to HHS's standard ⁴.
5. Count affected people by state. The total decides HHS timing, the count per state decides media notice ¹, and each state may add its own deadline.
6. Calendar the earliest deadline, draft the letters with counsel, and file with HHS through the breach portal ².

Preparation does most of the work: encrypted devices, clear reporting terms in each business associate agreement and a written incident plan. Our healthcare IT and dental office IT pages cover the systems most practices run.