The HIPAA Breach Notification Rule
When unsecured PHI is acquired, accessed, used, or disclosed in a way the Privacy Rule does not allow, HIPAA presumes a breach and sets deadlines for telling patients, HHS, and sometimes the media (45 CFR 164.400–414).
Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .
The short answer
An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI has been compromised. Affected individuals must be notified without unreasonable delay and no later than 60 calendar days after the breach is discovered.
The four-factor risk assessment (45 CFR 164.402)
- The nature and extent of the PHI involvedIncluding the types of identifiers and the likelihood of re-identification.
- The unauthorized person who used the PHI or received itFor example, another covered entity bound by HIPAA versus an unknown party.
- Whether the PHI was actually acquired or viewedA forensic finding that a lost laptop was never opened is relevant here.
- The extent to which the risk has been mitigatedSuch as obtaining reliable assurances the information was destroyed.
Keep the assessment in writing. The covered entity carries the burden of showing that notifications were made or that no breach occurred (45 CFR 164.414).
Who to notify, and when
| Notify | When | Regulation |
|---|---|---|
| Affected individuals | Without unreasonable delay, and no later than 60 calendar days after discovery | 164.404 |
| Prominent media in a state or jurisdiction | Same deadline, if more than 500 residents of that state or jurisdiction are affected | 164.406 |
| HHS — 500 or more individuals | At the same time as individual notice, through the HHS breach portal | 164.408 |
| HHS — fewer than 500 individuals | Within 60 days after the end of the calendar year in which the breach was discovered | 164.408 |
| Covered entity, by a business associate | Without unreasonable delay, and no later than 60 days after discovery | 164.410 |
State breach-notification laws can add requirements or shorter deadlines.
What is not a breach
The definition in 45 CFR 164.402 (opens in a new tab) has three exceptions: an unintentional, good-faith access by a workforce member acting within their authority, with no further impermissible use; an inadvertent disclosure between people authorised to access PHI at the same organisation or arrangement; and a disclosure where there is a good-faith belief the recipient could not have retained the information. PHI that is encrypted or destroyed in line with HHS guidance is not “unsecured,” so its loss does not trigger notification.
What the notice to individuals must include
Under 45 CFR 164.404(c) (opens in a new tab), in plain language: what happened and when; the types of PHI involved; steps individuals should take to protect themselves; what the organisation is doing to investigate, mitigate, and prevent recurrence; and contact procedures, including a toll-free number, email, website, or postal address.
Common questions
- When does the 60-day clock start?
- On the day the breach is discovered — or the first day it would have been known with reasonable diligence — by anyone in the workforce other than the person who committed it (45 CFR 164.404(a)(2)).
- Is a lost encrypted laptop a reportable breach?
- Not if the encryption meets HHS guidance and the key was not compromised, because the PHI is then not “unsecured.”
- Where are breaches of 500 or more people published?
- HHS posts them on the OCR breach portal, which is publicly searchable.
Sources
- Breach Notification Rule (opens in a new tab) — HHS Office for Civil Rights
- 45 CFR § 164.402 — Breach definitions (opens in a new tab) — Electronic Code of Federal Regulations
- 45 CFR § 164.404 — Notification to individuals (opens in a new tab) — Electronic Code of Federal Regulations
- Breach Portal: Notice to the Secretary of HHS (opens in a new tab) — HHS Office for Civil Rights
Questions about this page
Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.
Get in touch
Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .
Every requirement on this page is cited to the regulation or to HHS guidance. If you find one that has changed, tell us and we will correct it.