HIPAA breach notification: how the 60 day clock really works

Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured protected health information. Sixty days is a ceiling, not a target. This is education, not legal advice.

What discovery means

The regulation text for individual notice says a breach is treated as discovered on the first day it is known to the covered entity, or by exercising reasonable diligence would have been known. Knowledge held by a workforce member or agent, other than the person who committed the breach, is imputed to the entity.

For engineers this matters. If an alert fired on Monday and nobody looked until Friday, the rule can treat the knowledge date as the earlier one. Alert triage speed is a compliance matter.

What the individual notice contains

Section 164.404(c) says the notice should include, to the extent possible:

• a brief description of what happened, with the dates of the breach and discovery if known
• the types of unsecured PHI involved
• steps individuals should take to protect themselves
• what the entity is doing to investigate, reduce harm and prevent recurrence
• contact procedures, including a toll free number, email, website or postal address

It must be written in plain language.

Other recipients and deadlines

Notice to the Secretary of HHS depends on size. For breaches affecting 500 or more individuals, it goes in at the same time as the individual notice. For fewer than 500, the entity keeps a log and reports breaches discovered in a calendar year within 60 days after the year ends, per 164.408.

The rule text for individual notice is also subject to a law enforcement delay provision in 164.412, so check that with counsel if a delay request arrives.

Business associates

A business associate has its own duty. Under 164.410 it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, identifying each affected individual to the extent possible and providing information the covered entity needs for its own notice.

The two clocks stack. If your vendor takes 55 days to tell you, you have little time left, and your own discovery date may be argued to be earlier. Contracts commonly set much shorter vendor notice windows.

A practical sequence

1. Log the discovery date and who knew what.
2. Run the breach risk assessment. See our post on the four factors.
3. If it is a breach, draft individual, HHS and any other notices in parallel, not in order.
4. Record every decision. If you conclude there is no reportable breach, keep the assessment.

Quick check

Sources

• 45 CFR 164.404 individual notice
• 45 CFR 164.408 notice to the Secretary
• 45 CFR 164.410 business associate notice

Last reviewed: 19 October 2026.