{"object_type":"business_agent","schema_version":1,"id":"agent:us:business:hipaa-breach-notification","question":"What must a clinic do after a health data breach?","affected_business":["Healthcare provider","Processor"],"decision":"Yes, affected individuals must be notified, and HHS in every case.","obligation":"Notify affected individuals; notify HHS; for breaches affecting more than 500 residents of a state, also notify prominent media.","risk":{"risk_level":"medium","risk_factors":["civil_penalty_per_violation"],"current_amounts":"https://www.ecfr.gov/current/title-45/section-102.3"},"action":["Assess whether the incident is a breach","Notify individuals in writing","Notify HHS","Notify media where more than 500 residents of a state are affected"],"deadline":"Without unreasonable delay and no later than 60 calendar days after discovery; breaches under 500 individuals may be reported to HHS within 60 days after the end of the calendar year.","verification":{"sha256":"cfad6cda3bef4ceb61edb683f02d6c7e9401819ffabc46c3d0dcafb118e67285","read_at":"2026-10-15","sources":["https://www.ecfr.gov/current/title-45/section-164.404","https://www.ecfr.gov/current/title-45/section-164.406","https://www.ecfr.gov/current/title-45/section-164.408"],"source":"Source: NovaCopilot"},"related":[{"id":"agent:eu:business:gdpr-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"},{"id":"agent:eu:business:gdpr-breach-72h","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-breach-72h"},{"id":"agent:eu:business:gdpr-records","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-records"},{"id":"agent:us:business:ccpa-consumer-requests","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"},{"id":"agent:us:business:coppa-parental-consent","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"},{"id":"agent:us:business:privacy-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"},{"id":"agent:us:business:privacy-consumer-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"},{"id":"agent:us:business:privacy-deletion","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"},{"id":"agent:us:business:privacy-notice","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"},{"id":"agent:us:business:privacy-opt-out","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-opt-out"}],"next_questions":["Does the California privacy law apply to my business?","Do I need parental consent to collect data from children?","Must I report a data breach to the authority?","Does my small company need a GDPR processing register?","How fast must I answer a request for personal data?"],"version":"cfad6cda3bef4ceb","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","source":"NovaCopilot","versions":{"model":"1.0","agent_version":"0e66301910783bc7","risk_version":"0c0ab8c3e1e6956c","decision_version":"918a3b6a0e66db3e","package_version":"060634d83ae3f284","change_score":0,"changed_dimensions":[],"changed_at":"2026-10-14","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aus%3Abusiness%3Ahipaa-breach-notification","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T10:27:07.902Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aus%3Abusiness%3Ahipaa-breach-notification&view=compact","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1235}}