HIPAA Breach Notification Requirements

The HIPAA definition and presumption.

Under 45 CFR § 164.402, a breach is an impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises the security or privacy of the information. "Unsecured PHI" means PHI that is not encrypted to HHS specification or otherwise rendered unusable, unreadable, or indecipherable.

Presumption of breach: any impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity demonstrates low probability that PHI has been compromised based on a four-factor risk assessment (nature and extent of PHI involved, unauthorized person who used it, whether PHI was actually acquired or viewed, and mitigation extent).

Encryption as safe harbor: properly encrypted PHI that is compromised does not trigger breach notification. This is one reason encryption is core to HIPAA technical safeguard operations — see our HIPAA technical safeguards page.

Who gets notified and when.

Individual notification

Affected individuals must be notified without unreasonable delay and no later than 60 days from discovery. Notification must include description of breach, types of information involved, steps individuals can take to protect themselves, what the covered entity is doing to investigate and mitigate, and contact information. First-class mail is default; email if individual agreed; substitute notice (website, media) if contact information is insufficient for 10+ individuals.

HHS notification

Breaches affecting 500 or more individuals: HHS must be notified within 60 days of discovery, and the breach is posted on the HHS OCR breach portal ("Wall of Shame"). Breaches affecting fewer than 500: HHS notification within 60 days after end of calendar year. See HHS breach notification page for the reporting portal and official guidance.

Media notification

For breaches affecting 500 or more individuals in a single state or jurisdiction, prominent media outlets in that state/jurisdiction must be notified within 60 days of discovery. This is in addition to individual and HHS notification.

Business associate obligations

Business associates must notify the covered entity upon discovery of a breach. BAA specifies timing; regulation requires notification without unreasonable delay and no later than 60 days from discovery. Covered entity then handles individual, HHS, and media notification. See our BAA page.

Systematic response when breach is suspected.

Phase 1 — Detection and containment (0-72 hours)

Identify the incident, contain the exposure (disconnect affected systems, revoke compromised credentials, isolate the threat), preserve forensic evidence, and engage incident response team including legal counsel and technical expertise. See our incident response page.

Phase 2 — Investigation and breach determination (3-30 days)

Determine scope (what PHI was involved, how many individuals affected, what the exposure pathway was), conduct four-factor risk assessment to determine whether incident meets breach definition, document findings thoroughly. Legal counsel typically leads this determination given legal implications.

Phase 3 — Notification (within 60 days of discovery)

Prepare individual notification letters and distribute, submit HHS notification for breaches of 500+, coordinate media notification where applicable. Notification content must meet regulatory requirements — template notifications designed before incident response help.

Phase 4 — Remediation and documentation (ongoing)

Implement remediation to prevent recurrence, update risk assessment and policies, retain documentation for 6 years minimum (HIPAA retention requirement). Documentation may be subject to HHS investigation; quality of documentation materially affects investigation outcomes.