When something goes wrong with health data, the first hours are spent on the technical response. The HIPAA questions arrive soon after, and they are precise. Is this a breach? When did the clock start? Who has to be told, and by when? Teams that answer those questions for the first time during an incident tend to answer them late.
The Breach Notification Rule is in 45 CFR 164.400 to 164.414. It applies to covered entities and business associates, and it is more mechanical than most of HIPAA. This article goes through it in the order you would use it: deciding whether a breach occurred, working out the deadline, and identifying each party you owe notice. Notification decisions carry legal consequences, so confirm yours with counsel during a real incident.
Is it a breach?
A breach is the acquisition, access, use, or disclosure of PHI in a manner the Privacy Rule does not permit, which compromises the security or privacy of the PHI. Three situations are excluded:
An unintentional acquisition, access, or use by a workforce member or other person acting under your authority, made in good faith and within the scope of their authority, with no further impermissible use or disclosure.
An inadvertent disclosure from one person authorized to access PHI to another authorized person at the same covered entity or business associate, with no further impermissible use or disclosure.
A disclosure where you have a good faith belief that the recipient would not reasonably have been able to retain the information.
Outside those exclusions, an impermissible use or disclosure is presumed to be a breach. You can rebut the presumption only by showing a low probability that the PHI has been compromised, based on a risk assessment of at least four factors:
The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification
The unauthorized person who used the PHI or received it
Whether the PHI was actually acquired or viewed
The extent to which the risk has been mitigated
Document the assessment either way. Section 164.414 puts the burden of proof on you: you must be able to show that you made every required notification, or that the incident was not a breach.
A security incident under the Security Rule is not automatically a breach. A blocked intrusion attempt is a security incident with no PHI acquired or viewed. Ransomware is a case teams often misjudge. HHS guidance treats ransomware encryption of ePHI as presumed to be a breach, unless you can demonstrate a low probability of compromise through the four-factor assessment.
Unsecured PHI and the encryption safe harbor
The notification duties apply only to breaches of unsecured PHI. PHI is secured if it has been rendered unusable, unreadable, or indecipherable to unauthorized persons through a method HHS specifies in guidance. That guidance names two methods: encryption consistent with the NIST publications it cites, and destruction of the media.
Encryption only helps if the key was not compromised along with the data. Keep keys separate from the data they protect. A lost laptop with full-disk encryption is a different event from a lost laptop that was unlocked, or whose password was taped to it.
This is the practical reason to treat encryption as a default, even though the Security Rule lists it as addressable. HIPAA technical safeguards for SaaS teams covers where to apply it.
When the clock starts
A breach is treated as discovered on the first day it is known to the covered entity, or would have been known with reasonable diligence. Knowledge by any workforce member or agent counts, other than the person who committed the breach.
Two consequences follow. The clock starts at discovery, not when your investigation concludes. And "would have been known" means an alert nobody read can start the clock. If your monitoring flagged the activity on a given day, expect that day to be treated as the discovery date.
For a business associate that acts as the covered entity's agent under the federal common law of agency, HHS treats the business associate's discovery as the covered entity's. Whether a vendor is an agent depends on the facts of the relationship, which is another question for counsel.
Who must be notified, and by when
The deadlines run from discovery. Sixty calendar days is the outer limit. The actual standard is "without unreasonable delay," and waiting until day 59 with the facts in hand may not meet it.
| Recipient | When it applies | Deadline |
|---|---|---|
| Affected individuals | Every breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery |
| Prominent media outlets | More than 500 residents of one state or jurisdiction affected | Same as individual notice |
| HHS | 500 or more individuals affected | At the same time as individual notice |
| HHS | Fewer than 500 individuals affected | Within 60 days after the end of the calendar year in which the breach was discovered |
| The covered entity (from a business associate) | Every breach of unsecured PHI at the business associate | Without unreasonable delay, no later than 60 calendar days after discovery |
The thresholds use different wording. Media notice applies to more than 500 residents of a single state or jurisdiction. Notice to HHS alongside the individual notices applies to 500 or more individuals in total. A breach of 800 people spread across several states, with no state above 500, can therefore require prompt HHS notice but no media notice. HHS posts breaches of 500 or more individuals on a public website.
Breaches under 500 still need a record. Keep a log through the year and submit each breach to HHS through its web portal within the annual window.
What the individual notice must contain
Notice goes by first-class mail to the last known address, or by email if the individual has agreed to electronic notice. It must be written in plain language and include:
A brief description of what happened, with the date of the breach and the date of discovery, if known
The types of unsecured PHI involved, such as names, dates of birth, Social Security numbers, diagnoses, or account numbers
Steps individuals should take to protect themselves
What you are doing to investigate, mitigate harm, and prevent recurrence
Contact procedures, including a toll-free number, an email address, a website, or a postal address
If contact information is out of date, substitute notice applies. For fewer than 10 individuals, an alternative written notice, a phone call, or other means will do. For 10 or more, you need either a conspicuous posting on your website's home page for 90 days or a conspicuous notice in major print or broadcast media where those individuals likely live. Either form must include a toll-free number that stays active for at least 90 days. Where misuse is imminent, you may also call affected individuals.
What business associates owe
A business associate notifies the covered entity, not the individuals. The notice must identify each affected individual as far as possible, and include the other information the covered entity needs for its own notices. The covered entity then notifies individuals, unless the agreement delegates that task.
Contracts often shorten the 60-day window considerably. That is reasonable, because the covered entity needs time to meet its own deadline. Check what your agreements say before you need them. Business associate agreements: what to check before signing covers that clause.
Law enforcement delay
If a law enforcement official states that notice would impede a criminal investigation or damage national security, you delay. A written statement specifying a period delays notice for that period. An oral statement delays it for no more than 30 days from the statement, unless a written one follows. Document the oral statement, including the official's identity.
State breach notification laws can also apply, with their own definitions, deadlines, and regulators. They vary by state and change often, so confirm which apply to each incident.
Prepare the decisions before the incident
Write the breach determination into your incident procedure as a named step with an owner. Include the four-factor assessment form, the notice template, the HHS submission steps, and a contact list of each customer's notification address and contractual deadline. The HIPAA framework page and the glossary define the terms you will need. A tabletop exercise that runs one hypothetical breach through every step will show where the procedure is thin.