What must a clinic do after a health data breach?

Healthcare provider, Processor

HIPAA covered entities and their business associates after a breach of unsecured protected health information.

Yes, affected individuals must be notified, and HHS in every case.

Notify affected individuals; notify HHS; for breaches affecting more than 500 residents of a state, also notify prominent media.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Assess whether the incident is a breach
2. Notify individuals in writing
3. Notify HHS
4. Notify media where more than 500 residents of a state are affected

Without unreasonable delay and no later than 60 calendar days after discovery; breaches under 500 individuals may be reported to HHS within 60 days after the end of the calendar year.

• 45 CFR 164.404
• 45 CFR 164.406
• 45 CFR 164.408

sha256 cfad6cda3bef4ceb61edb683f02d6c7e9401819ffabc46c3d0dcafb118e67285 · read 2026-10-15 · Source: NovaCopilot

• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• Must I report a data breach to the authority?
• Does my small company need a GDPR processing register?
• How fast must I answer a request for personal data?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)
• agent:us:business:privacy-opt-out (business_agent)