Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Business associates owe the covered entity the same outer limit. HHS notice is immediate for breaches of 500 or more people and annual for smaller ones.
What counts as a breach
Section 164.402 defines a breach as an acquisition, access, use or disclosure of PHI not permitted by the Privacy Rule that compromises its security or privacy. Three narrow exclusions cover good faith unintentional access by workforce, inadvertent disclosures between authorised people at the same organisation, and cases where the recipient could not reasonably retain the data.
Everything else is presumed a breach unless you show a low probability of compromise through a documented risk assessment of at least four factors: the nature and extent of the PHI and the chance of re-identification, who used or received it, whether it was actually acquired or viewed, and how far the risk has been mitigated.
Only unsecured PHI triggers notification. That is PHI not rendered unusable, unreadable or indecipherable through a method the Secretary specified in guidance.
When the clock starts
Discovery is the first day the breach is known, or would have been known with reasonable diligence. Knowledge by any workforce member or agent, other than the person who committed the breach, counts for the organisation. That means a delay in escalating an alert inside your team can start the clock earlier than you expect.
The deadlines
| Who is told | Deadline | Section |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 calendar days | 164.404 |
| Media, for more than 500 residents of a state | Same 60 day limit | 164.406 |
| HHS, 500 or more people | Contemporaneously with the individual notice | 164.408 |
| HHS, fewer than 500 people | Within 60 days after the end of the calendar year of discovery | 164.408 |
| Covered entity, from a business associate | Without unreasonable delay, no later than 60 calendar days | 164.410 |
Sixty days is a ceiling, not a target. The rule says without unreasonable delay, so waiting until day 59 with a finished investigation can still be late.
What the notice must say
The individual notice must be in plain language and include what happened with dates, the types of PHI involved, steps people should take, what the entity is doing, and contact methods that include a toll free number, email, website or postal address.
For vendors and engineers
If you are a business associate, your contract probably sets a shorter reporting window than 60 days, so read it. Build the evidence ahead of time: which systems hold PHI, who accessed what, and whether the data was encrypted. Good logging turns the four factor risk assessment from a guess into a record. See audit controls and log review.
Quick check
Do small breaches need to be reported to HHS?
Yes, but on a calendar year basis. For fewer than 500 individuals, keep a log and notify HHS within 60 days after the end of the year of discovery.
Is the 60 days counted from when we finished investigating?
No. It runs from discovery, which includes when the breach would have been known with reasonable diligence.
Sources
- 45 CFR 164.402, definitions
- 45 CFR 164.404, notification to individuals
- 45 CFR 164.406, notification to the media
- 45 CFR 164.408, notification to the Secretary
- 45 CFR 164.410, notification by a business associate
Last reviewed: 19 October 2026.
