What are the HIPAA breach notification deadlines?

• Federal level

  Notice to affected individuals goes out without unreasonable delay and no later than 60 calendar days after discovery of the breach.

  45 CFR §§ 164.400 to 164.414

• Sector rule

  A breach affecting 500 or more residents of a state also requires notice to prominent media and to the Secretary within the same 60 days. Smaller breaches are logged and reported annually within 60 days after the calendar year ends.

  HHS Breach Portal, notification to the Secretary

• Enforcement

  The Security Rule requires the administrative, physical and technical safeguards that the breach analysis is measured against.

  45 CFR Part 164, Subpart C

• The Breach Notification Rule sets discovery as the day the breach is known, or would have been known with reasonable diligence, to any workforce member.
• An impermissible use or disclosure is presumed a breach unless a four factor risk assessment shows a low probability that protected health information was compromised.
• Business associates notify the covered entity without unreasonable delay and no later than 60 days after discovery.

The deadline is a ceiling, not a target. The presumption of breach means the burden sits with the covered entity to document the risk assessment that avoided notification.

Patients receive a written notice describing what happened, what information was involved and what steps they can take. The public breach portal lists incidents of 500 or more.

Record the discovery date for every reported event and run the four factor assessment in writing before deciding not to notify.

All US questions