{"object_type":"business_agent","schema_version":1,"title":"HIPAA breach notification","core":{"id":"agent:us:business:hipaa-breach-notification","jurisdiction":"us","domain":"privacy","question":"What must a clinic do after a health data breach?","affected_business":["Healthcare provider","Processor"],"applies_when":"HIPAA covered entities and their business associates after a breach of unsecured protected health information.","decision":"Yes, affected individuals must be notified, and HHS in every case.","obligation":"Notify affected individuals; notify HHS; for breaches affecting more than 500 residents of a state, also notify prominent media.","action":["Assess whether the incident is a breach","Notify individuals in writing","Notify HHS","Notify media where more than 500 residents of a state are affected"],"deadline":"Without unreasonable delay and no later than 60 calendar days after discovery; breaches under 500 individuals may be reported to HHS within 60 days after the end of the calendar year.","sources":[{"provision":"45 CFR 164.404","url":"https://www.ecfr.gov/current/title-45/section-164.404"},{"provision":"45 CFR 164.406","url":"https://www.ecfr.gov/current/title-45/section-164.406"},{"provision":"45 CFR 164.408","url":"https://www.ecfr.gov/current/title-45/section-164.408"}],"read_at":"2026-10-15"},"sha256":"cfad6cda3bef4ceb61edb683f02d6c7e9401819ffabc46c3d0dcafb118e67285","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Healthcare provider","Processor"],"applies_when":"HIPAA covered entities and their business associates after a breach of unsecured protected health information.","decision":"Yes, affected individuals must be notified, and HHS in every case.","obligation":"Notify affected individuals; notify HHS; for breaches affecting more than 500 residents of a state, also notify prominent media.","risk":{"risk_level":"medium","risk_factors":["civil_penalty_per_violation"],"current_amounts":"https://www.ecfr.gov/current/title-45/section-102.3"},"action":["Assess whether the incident is a breach","Notify individuals in writing","Notify HHS","Notify media where more than 500 residents of a state are affected"],"deadline":"Without unreasonable delay and no later than 60 calendar days after discovery; breaches under 500 individuals may be reported to HHS within 60 days after the end of the calendar year.","verification":{"sha256":"cfad6cda3bef4ceb61edb683f02d6c7e9401819ffabc46c3d0dcafb118e67285","read_at":"2026-10-15","sources":["https://www.ecfr.gov/current/title-45/section-164.404","https://www.ecfr.gov/current/title-45/section-164.406","https://www.ecfr.gov/current/title-45/section-164.408"],"source":"Source: NovaCopilot"},"next_questions":["Does the California privacy law apply to my business?","Do I need parental consent to collect data from children?","Must I report a data breach to the authority?","Does my small company need a GDPR processing register?","How fast must I answer a request for personal data?"],"related":[{"id":"agent:eu:business:gdpr-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"},{"id":"agent:eu:business:gdpr-breach-72h","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-breach-72h"},{"id":"agent:eu:business:gdpr-records","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-records"},{"id":"agent:us:business:ccpa-consumer-requests","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"},{"id":"agent:us:business:coppa-parental-consent","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"},{"id":"agent:us:business:privacy-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"},{"id":"agent:us:business:privacy-consumer-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"},{"id":"agent:us:business:privacy-deletion","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"},{"id":"agent:us:business:privacy-notice","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"},{"id":"agent:us:business:privacy-opt-out","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-opt-out"}],"related_count":11,"page":"https://legal.exploreworldai.com/en/business-agents/us-hipaa-breach-notification","version":"cfad6cda3bef4ceb","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"0e66301910783bc7","risk_version":"0c0ab8c3e1e6956c","decision_version":"918a3b6a0e66db3e","package_version":"060634d83ae3f284","change_score":0,"changed_dimensions":[],"changed_at":"2026-10-14","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aus%3Abusiness%3Ahipaa-breach-notification","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/business-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"links_full":11,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T11:42:49.968Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aus%3Abusiness%3Ahipaa-breach-notification","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1902}}