{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/us:hipaa-art-164-408-covered-entity",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/us:hipaa-art-164-408-covered-entity)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-10",
    "fingerprint": "ewai:se:f28bfe",
    "proof": "sha256:c9a378ea1c24adc7291f4276f992708d865ec17548439ab3c9e00a89e02ecae6",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "object_type": "compliance_effect",
  "object_id": "compliance_effect:us:hipaa-art-164-408-covered-entity",
  "schema_version": "1",
  "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/compliance_effect",
  "url": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/us:hipaa-art-164-408-covered-entity",
  "source": "NovaCopilot",
  "item": {
    "obligation": "obligation:us:hipaa-art-164-408-covered-entity",
    "who": "covered-entity",
    "must_do": "Notify the Secretary of HHS of breaches of unsecured protected health information.",
    "deadline": "60 days",
    "deadline_note": "Breaches of 500 or more individuals: at the same time as individual notice, no later than 60 days after discovery. Fewer than 500: log and report within 60 days after the end of each calendar year.",
    "report_to": "Secretary of Health and Human Services",
    "triggered_by": [],
    "if_not": [
      {
        "sanction_id": "sanction:us:hipaa-art-1320d-5",
        "type": "civil_penalty",
        "max_amount": "USD 100 to 50 000 per violation in four culpability tiers, at most USD 1 500 000 per calendar year for identical violations (statute text; inflation-adjusted under 45 CFR 102.3)",
        "max_turnover_pct": null
      }
    ],
    "source": "45 CFR 164.408 (HIPAA Breach Notification Rule)",
    "source_url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D",
    "gaps": [],
    "hash": "5e3a3dfe7e17a23dec780d75eb5dfc44722c62a0a739ebc98e9fc9b9810d42fd"
  },
  "watch": {
    "changes": "https://legal.exploreworldai.com/api/public/v1/changes",
    "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=us",
    "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.",
    "recheck_after_seconds": 86400
  },
  "hash": "sha256:c9a378ea1c24adc7291f4276f992708d865ec17548439ab3c9e00a89e02ecae6",
  "version": "legal-2026-10-10",
  "expires": "2026-10-12T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-10+legal-2026-10-10+2026-10-10T17:32:53",
    "content_hash": "sha256:c9a378ea1c24adc7291f4276f992708d865ec17548439ab3c9e00a89e02ecae6",
    "revalidate_after": "2026-10-11T08:24:06.291Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/us:hipaa-art-164-408-covered-entity",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "item.links": 5,
    "links": 7
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}