Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Sixty days is the outer limit, not a goal. A delay with no good reason can violate the rule even inside 60 days.
When the clock starts
A breach is treated as discovered on the first day it is known to the covered entity, or would have been known with reasonable diligence. Knowledge held by any workforce member or agent counts, other than the person who committed the breach.
That second part surprises people. If a help desk employee sees evidence on Monday and tells no one, the clock may still be running from Monday.
What the individual notice must contain
Written in plain language, to the extent possible:
- A brief description of what happened, with the breach date and discovery date if known.
- The types of information involved, such as names, Social Security numbers, birth dates, addresses, account numbers or diagnoses.
- Steps individuals can take to protect themselves.
- What the entity is doing to investigate, reduce harm and prevent recurrence.
- Contact options, including at least one of a toll free number, an email address, a website or a postal address.
Notice to HHS
For breaches affecting 500 or more individuals, notify the Secretary at the same time as the individual notice, using the method HHS specifies on its website. For fewer than 500, keep a log of each breach and report them to HHS within 60 days after the end of the calendar year in which they were discovered.
Delay exception
Section 164.412 allows delay in certain law enforcement situations. Do not assume it applies. Ask counsel.
Prepare before it happens
- Draft notice templates in plain language now.
- Define who can declare a breach, and how quickly staff must escalate.
- Know your state breach laws, which can set shorter deadlines. I did not verify specific state rules here.
- Keep an incident log from day one, with times.
- Check your cyber insurance notice terms.
See also business associate notice duties. This is general information, not legal advice.
Quick check
Do I have a full 60 days no matter what?
No. Notice must be without unreasonable delay, and 60 calendar days from discovery is the latest allowed.
When is a breach discovered?
On the first day it is known, or would have been known with reasonable diligence, to the entity, including through workforce members or agents.
Sources
- 45 CFR 164.404, Notification to individuals (eCFR)
- 45 CFR 164.408, Notification to the Secretary (eCFR)
Last reviewed: 19 October 2026.
