Under 45 CFR 164.410, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The notice should identify each affected individual where possible. Contracts often set much shorter windows, so read your business associate agreement first.
The rule in plain terms
A breach is discovered on the first day it is known to the business associate, or would have been known with reasonable diligence. Knowledge of any employee, officer or agent, except the person who committed the breach, is attributed to the business associate.
The outer limit is 60 calendar days. Like the covered entity rule, it also says without unreasonable delay. A law enforcement delay under 164.412 can pause the clock in limited cases.
What to send
The notice should identify each individual whose information was, or is reasonably believed to have been, involved, to the extent possible. The business associate must also provide other information the covered entity needs for its own notice to individuals. That can come with the first notice if available, or follow promptly as facts emerge.
This matters because the covered entity must tell patients what happened, what data was involved, and what it is doing. If you give them thin facts, they cannot write that notice.
Why contracts go shorter
The covered entity has its own 60 day clock, and a slow notice from you leaves it less time. Many agreements therefore ask for notice in days. I have not verified typical contract periods, so check yours.
A workable vendor playbook
- Know which customers' data each system holds, so scoping is quick.
- Keep a contact list for each covered entity customer.
- Start an incident log with discovery time and who knew what, when.
- Send a first notice early with what you know, then update.
- Preserve logs and evidence.
- Keep a template for the affected individual list.
Subcontractors
If you use subcontractors that handle PHI, they have to tell you. Build the same short timelines into those agreements. See also the covered entity side. This is general information, not legal advice.
Quick check
What is the maximum time a business associate has to notify?
No later than 60 calendar days after discovery, and without unreasonable delay. Contracts may require less.
Sources
Last reviewed: 19 October 2026.
