HIPAA Breach Notification Timeline

The HIPAA breach notification timeline gives covered entities and business associates strict deadlines after a breach of unsecured protected health information. Individual notifications must go out within 60 days of discovery. If more than 500 people who live in one state or jurisdiction are affected, you must also tell major media outlets there within the same 60 days.

Every breach must be reported to HHS. For 500 or more people, report to HHS at the same time you notify the individuals. For smaller breaches, keep a log and send it to HHS within 60 days after the calendar year ends.

The breach notification rule is one of HIPAA's most demanding rules. When a breach of unsecured health data occurs, covered entities and business associates must act fast. Failing to meet notification rules adds penalties, legal liability, and lasting reputational damage.

This guide covers every part of HIPAA breach notification compliance. It walks through determining whether an incident is reportable, meeting timelines, and documenting your response. It also covers how federal and state rules interact.

Understanding the Breach Notification Rule

What counts as a Breach

The HIPAA Breach Notification Rule is written into federal law at 45 CFR 164.400-414. It defines a breach as getting, accessing, using, or sharing PHI in a way the Privacy Rule does not allow. The incident must compromise the security or privacy of the PHI.

Not every security incident is a breach. The definition has key qualifications:

• The incident must involve PHI. Security events on systems without PHI do not trigger HIPAA notification rules.
• The access or sharing must violate the Privacy Rule. Authorized uses of PHI, even if they seem wrong, may not be breaches if they fall within allowed categories.
• The security or privacy of the PHI must be compromised. The rule assumes it is a breach. You can show otherwise only with a risk assessment that finds a low probability (a low chance) that the PHI was compromised.

Three Exceptions to the Breach Definition

The Breach Notification Rule has three narrow exceptions. In these cases, using or sharing PHI in a way the Privacy Rule does not allow still does not count as a breach:

1. Unintentional acquisition by a workforce member: Good-faith, unintentional acquisition, access, or use of PHI by a workforce member acting within their authority. The information must not be used or shared any further in a way the Privacy Rule does not allow.

2. Inadvertent sharing between authorized persons: Inadvertent sharing by one authorized person to another authorized person at the same covered entity or business associate. The information must not be used or shared any further in a way the Privacy Rule does not allow.

3. Good-faith belief of inability to retain: A disclosure (sharing) where the covered entity or business associate honestly believes the wrong person who received it could not reasonably have kept the information.

If none of these exceptions apply, the practice must do a risk assessment to decide if notice is needed.

The Four-Factor Risk Assessment

Sometimes PHI is used or shared in a way the Privacy Rule does not allow, and no exception applies. The law then assumes it is a breach. The covered entity or business associate can prove otherwise only with a risk assessment. The assessment must weigh at least four factors. Together, they show whether there is a low probability that the PHI was compromised.

Factor 1: Nature and Extent of PHI Involved

Evaluate the types and sensitivity of PHI involved in the incident.

Consider:

• What specific data elements were exposed (names, diagnoses, Social Security numbers, financial information).
• Whether the PHI includes sensitive categories such as mental health, substance abuse, HIV/AIDS, or genetic information.
• The volume of records affected.
• Whether the PHI includes enough information to identify people directly.

More sensitive and more identifiable information raises the chance that the incident is a reportable breach.

Factor 2: The Unauthorized Person Who Used or Received the PHI

Identify who impermissibly accessed or received the PHI. Evaluate the risk tied to that person's access.

Consider:

• Whether the recipient is a covered entity or business associate with their own rules to protect PHI.
• Whether the recipient has a professional duty of data privacy (such as a physician at another practice).
• Whether the recipient is an unknown or malicious actor.
• Whether the recipient has shown any intent to misuse the information.

Sharing with another covered entity usually carries lower risk than exposure to unknown attackers.

Factor 3: Whether the PHI Was Actually Acquired or Viewed

Determine whether the PHI was actually accessed, viewed, or acquired. This differs from simply being exposed to the possibility of access.

Consider:

• Whether audit logs confirm that data was actually accessed or downloaded.
• Whether the exposure was theoretical (for example, a lost unencrypted laptop recovered with no sign of access).
• Whether forensic analysis can determine the extent of actual data access.
• The duration of the exposure period.

Evidence that PHI was not actually viewed reduces the risk. It does not eliminate it entirely.

Factor 4: Extent to Which the Risk Has Been Reduced

Evaluate the steps taken to reduce the risk of harm after the incident.

Consider:

• Whether the PHI was recovered before it could be further disclosed.
• Whether the recipient gave assurances that the information was destroyed and not retained.
• Whether the recipient can be trusted to honor destruction assurances.
• Whether tech measures are in place to prevent further access.

Effective risk reduction can lower the overall risk. Practices should record all risk reduction efforts thoroughly.

Making the Decision

After checking all four factors, the practice must determine whether there is a low probability that the PHI has been compromised. If the practice cannot show a low probability of compromise, the incident is presumed to be a breach. Notice is then required.

Important: The practice carries the burden of proof. That means it is up to you to show you followed the rule. If you decide not to notify, you must write down the risk assessment that shows notice is not required. OCR looks closely at these decisions during investigations.

Notification Requirements and Timelines

The 60-Day Rule

Covered entities must provide breach notification without unreasonable delay and no later than 60 calendar days after discovering the breach. This is a firm deadline, not a target.

Key timing factors:

• Discovery date: A breach is considered discovered on the first day it is known to the covered entity, or the day it reasonably should have been known. It counts as discovered once any workforce member or agent of the entity knows about it. The one exception is the person who caused the breach.
• Knowledge imputation: If an employee discovers a breach on Day 1 but does not report it until Day 15, the discovery date is still Day 1.
• Investigation period: The 60-day clock starts at discovery, not at the end of the investigation. Practices may begin notices while the investigation continues.

Individual Notification

Every person whose unsecured PHI has been, or is reasonably believed to have been, affected must be notified. This covers access, acquisition, use, or sharing as a result of the breach.

Individual notification must include, to the extent possible:

• A brief description of the breach, including the date of the breach and the date of discovery.
• A description of the types of unsecured PHI involved (such as name, Social Security number, date of birth, diagnosis).
• Steps the person should take to protect themselves from possible harm.
• A description of what the covered entity is doing to investigate the breach, reduce harm to individuals, and protect against further breaches.
• Contact information for the covered entity, including a toll-free number, email address, postal address, or website.

Delivery rules:

• Written notice sent by first-class mail to the person's last known address.
• If the person agreed to digital notices, notice may be sent by email.
• If contact information is missing or out of date for 10 or more people, substitute notice must be posted on the home page of the practice's website for 90 days or through major print or broadcast media.
• For urgent cases where the PHI could be misused very soon, practices may add telephone notice to written notice.

HHS Notification

All breaches must be reported to the Department of Health and Human Services (HHS) through its online breach portal.

For breaches affecting 500 or more people:

• Notice to HHS must occur at the same time as individual notification, within 60 days of discovery.
• HHS publishes these breaches on its public Breach Portal (commonly known as the "Wall of Shame").
• OCR may start an investigation after notice.

For breaches affecting fewer than 500 people:

• Practices must keep a log of smaller breaches and submit them to HHS annually, no later than 60 days after the end of the calendar year in which the breaches were discovered.

Media Notification

For breaches affecting more than 500 residents of a single state or jurisdiction, the covered entity must notify prominent media outlets serving that area.

Media notification rules:

• Must be provided without unreasonable delay and no later than 60 days after discovery.
• Must include the same content elements required for individual notification.
• Should be sent as press releases to major media outlets in the affected area.

Business Associate Duties

Business associates that discover a breach of unsecured PHI must notify the covered entity without unreasonable delay. This must happen no later than 60 days after discovery.

Business associate notice must include, to the extent possible:

• Identification of each person whose PHI has been or is reasonably believed to have been affected.
• Any other available information that the covered entity needs to include in its notices.

The covered entity stays responsible for notifying people, HHS, and media outlets. The BAA may assign these tasks differently, but the covered entity keeps final responsibility.

Documentation Requirements

What to Document

Thorough documentation is essential during OCR investigations. It also helps defend against possible legal claims. Practices should keep full records of all breach-related actions.

Documentation to keep includes:

• Risk assessment: The complete four-factor risk assessment, including all evidence, analysis, and the rationale for the final decision.
• Notification records: Copies of all notification letters, proof of mailing, email delivery confirmations, and evidence of substitute notice.
• Timeline: A detailed timeline of discovery, investigation, risk assessment, notice, and fixes.
• Investigation findings: Forensic analysis reports, root cause findings, and scope of data exposure.
• Risk reduction actions: All steps taken to contain the breach, reduce harm, and prevent recurrence.
• Training records: Evidence that workforce members involved in the response were properly trained.

Retention Requirements

HIPAA requires breach notification documentation to be kept for a minimum of six years from the date of creation or the date when the record was last in effect, whichever is later. Practices should keep records longer if litigation is pending or reasonably expected.

Creating a Breach Log

Keep a central breach log that tracks all possible and confirmed breaches. This log should include:

• Incident date and discovery date.
• Description of the incident.
• Number of people affected.
• Types of PHI involved.
• Risk assessment outcome (breach vs. non-breach decision).
• Notice dates (individuals, HHS, media).
• Remediation actions taken.
• Status (open, closed, monitoring).

This log serves as the master record for annual HHS reporting of smaller breaches. It also gives a full view of the practice's breach history.

State Law Interaction

Navigating Dual Requirements

HIPAA sets a federal floor for breach notification. Most states have also passed their own breach notification laws with extra or different rules. Healthcare practices must comply with both HIPAA and relevant state laws.

Common areas where state laws differ from HIPAA:

• Notice timelines: Several states require notice in as few as 30 days, much shorter than HIPAA's 60-day window.
• Definition of personal information: State laws may protect categories beyond what HIPAA considers PHI, such as biometric data, login credentials, or student records.
• Attorney general notice: Many states require notice to the state attorney general in addition to HHS. See our state privacy laws vs HIPAA guide for a state-by-state breakdown.
• Content rules: Some states require specific content in notification letters, credit monitoring offers, or identity theft prevention services.
• Private right of action: Some states allow people to sue directly for notice failures, creating legal risk beyond HIPAA enforcement.

Practical Compliance Approach

Given the complexity of overlapping rules, practices should:

• Map relevant state privacy laws for every state where affected individuals live, not just where the practice is located.
• Default to the most restrictive rule when federal and state timelines, content rules, or notice recipients differ.
• Engage legal counsel experienced in both HIPAA and state breach notification law during every breach response.
• Build flexibility into notice templates to handle varying state rules without creating separate notices for each jurisdiction.
• Monitor legislative changes because state breach notification laws change often and new states keep enacting or strengthening their rules.

Building Your Breach Notification Program

Pre-Breach Preparation

Prepare for breach notification before a breach occurs. Practices that invest in preparation respond faster, more accurately, and with less disruption.

Essential preparation steps:

• Develop and keep an incident response plan that includes detailed breach notification steps. See our healthcare data breach prevention guide for full planning guidance.
• Create notice templates pre-approved by legal counsel that can be quickly customized for specific incidents.
• Identify notice resources including mailing vendors, call center providers, and credit monitoring services that can be activated quickly.
• Set up relationships with forensic investigators, outside counsel, and public relations firms before you need them.
• Train your team on spotting and reporting breaches so incidents are found and escalated promptly.
• Conduct tabletop exercises that walk through breach notification scenarios to test timelines, decisions, and communication steps.

During a Breach

When a breach is discovered, execute your plan with care. Keep detailed documentation throughout.

1. Activate your incident response team and begin the investigation right away.
2. Contain the breach to prevent further unapproved access or sharing.
3. Preserve evidence for forensic analysis and possible legal proceedings.
4. Conduct the four-factor risk assessment to determine notification duties.
5. Engage legal counsel to guide notice decisions and regulatory interactions.
6. Prepare notice items including letters to individuals, HHS submission, and media statements.
7. Deliver notices within required timelines, documenting delivery for every person.
8. Activate support services such as call centers and credit monitoring for affected individuals.
9. Cooperate with regulators if OCR starts an investigation after notice.
10. Conduct a post-incident assessment and update your program based on lessons learned.

Breach Notification Violation Penalties

Failing to comply with breach notification requirements carries the same penalty tiers as any other HIPAA violation. Figures shown are the current amounts in 45 CFR 102.3, from the inflation adjustment HHS published January 28, 2026 (91 FR 3665).

45 CFR 102.3 sets the calendar-year cap for identical violations at $2,190,294 in every tier. Since 2019, HHS has applied lower annual caps to the first three tiers as a matter of enforcement discretion (84 FR 18151): $25,000, $100,000 and $250,000, "as adjusted for inflation".

Criminal Penalties for HIPAA Violations

Understanding what triggers a HIPAA investigation helps you avoid reaching this point. In addition to civil penalties imposed by OCR, the Department of Justice can pursue criminal charges against individuals who knowingly obtain or disclose PHI in violation of HIPAA.

Healthcare Breach Types by Category

Understanding how breaches are classified helps organizations focus prevention efforts on the highest-risk vectors. The order below shows the general pattern in recent OCR breach portal data for breaches of 500 or more people. The exact shares change each year.

Notable Breach Enforcement Cases

These enforcement actions show how OCR handles breach cases and what failures can cost. Only the Presence Health case was mainly about late notice.

Breach Notification FAQ

How quickly must covered entities notify HHS of a large breach?

For a breach affecting 500 or more individuals, the covered entity must notify HHS "contemporaneously with the notice required by § 164.404(a)" (45 CFR 164.408(b)), which means at the same time as the notices to individuals,, and that notice to individuals is due "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (45 CFR 164.404(b)). HHS has not published a proposed rule that would shorten these deadlines to 72 hours. The Security Rule changes HHS proposed on January 6, 2025 (90 FR 898) include restoring critical systems and data "within 72 hours of the loss"; that is a restoration deadline, not a notice deadline, and it is not final. For the first hours of a ransomware response, see the 72-hour response guide.

Does a ransomware attack automatically require HIPAA breach notification?

Not automatically, but HHS guidance strongly presumes it does. When ransomware encrypts ePHI, HHS considers the PHI to have been acquired by an unauthorized party unless the covered entity can demonstrate through the four-factor Breach Risk Assessment that there is a low probability of compromise. That demonstration is difficult in most ransomware scenarios. The practical standard: assume a ransomware attack involving ePHI is a reportable breach unless forensic evidence proves otherwise, and begin your 60-day clock from the date of discovery.

What happens if a covered entity misses the 60-day notification deadline?

Missing the 60-day deadline is itself a HIPAA violation, separate from the underlying breach. When OCR sets a penalty, it looks at factors such as how many people were affected, how long the violation lasted, and how much harm it caused. These factors can raise or lower the amount (45 CFR 160.408). Penalties range from $145 per violation (Tier 1: did not know) to $2,190,294 for identical violations in a calendar year (Tier 4: willful neglect, not corrected), per 45 CFR 102.3. The only safe approach is to build notification workflows that consistently meet or beat the 60-day window. For more on HIPAA enforcement, see our HIPAA fines breakdown.

Who is responsible for breach notification when a business associate causes the breach?

The covered entity bears ultimate responsibility for all required notifications to individuals, HHS, and media outlets, even when a business associate caused the breach. The business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering the breach. The Business Associate Agreement may assign specific tasks to the BA, but it cannot transfer the covered entity’s legal obligation to notify. Both the covered entity and the business associate may face separate OCR enforcement actions arising from the same breach.

How do I submit a breach to the HHS Breach Portal, and what is the Wall of Shame?

All HIPAA breaches must be reported to HHS through the Breach Reporting Portal at hhs.gov/hipaa. For breaches affecting 500 or more individuals, submission is required within 60 days of discovery. HHS publishes all large-breach submissions on a publicly searchable database informally called the “Wall of Shame”; its official name is the Breach Reporting Portal. The listing shows the organization name, state, type of organization, number of people affected, type of breach, and where the breached information was kept (for example, email or a network server). For breaches affecting fewer than 500 people, covered entities keep a breach log. They send it to HHS within 60 days after the end of the calendar year in which the breaches were discovered (March 1 in most years).

HIPAA Breach Response Timeline at a Glance

The table below maps the required actions and deadlines from the moment a breach is discovered. Use it as a reference during incident response to ensure no deadline is missed. The last column shows that the Security Rule changes HHS proposed on January 6, 2025 (90 FR 898) would leave these breach notification steps unchanged.

State Breach Notification Laws Stricter Than HIPAA

HIPAA establishes a federal floor for breach notification; it does not preempt state laws that provide greater patient protections. Healthcare organizations must comply with both HIPAA and any applicable state law. When a state deadline that applies to you is shorter than HIPAA’s 60-day window, you must meet the state deadline. See our state privacy laws vs. HIPAA guide for a comprehensive state-by-state comparison.

The states below add their own breach notice duties for healthcare organizations. Examples include shorter deadlines or notices to state officials. Some accept HIPAA-compliant notice to patients as meeting their own rules. Check each law with your lawyer.

Practical implication: If a breach affects patients in Texas, Florida, New York, or California, at least one state deadline may be 30 days or fewer, not 60 days. Build your breach response program around the most restrictive applicable state deadline, not the HIPAA ceiling. Engage legal counsel experienced in multi-state breach notification before an incident occurs.

Sample Breach Notification Letter Language

The following is sample language that satisfies the content requirements of 45 CFR 164.404(c). It is a starting template only; your legal counsel must review and customize it for every specific breach before sending. State law requirements may add or modify required elements.

Note on substitute notice: If contact information is missing or out of date for 10 or more affected individuals, 45 CFR 164.404(d) requires substitute notice. That means a clear posting on the home page of the covered entity’s website for 90 days, or notice in major print or broadcast media in the areas where the affected people likely live. The substitute notice must include a toll-free number active for at least 90 days.

Breach Notification Takeaways

The HIPAA Breach Notification Rule demands preparation, precision, and speed. Practices that invest in pre-breach planning and train their team to identify and report incidents promptly are best positioned to meet their duties. Having the systems in place for rapid notice minimizes harm to affected individuals and to the practice itself.

Breach Notification is not merely a regulatory checkbox. It shows your practice's commitment to transparency, accountability, and patient trust. When handled well, even a serious breach can be managed in a way that preserves credibility and satisfies regulatory rules.

One Guy Consulting helps practices get ready for breach notification. The portal includes an incident management system. The Full-Scope plan adds incident response guidance as needed. Read our guide to building an incident response plan. Or get HIPAA compliance help so your practice is ready to meet its notification duties when it matters most.

Frequently Asked Questions

When a breach of PHI affects more than 500 individuals, what must a covered entity do?

When a breach of PHI affects more than 500 individuals, the covered entity must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovering the breach. The entity must also notify the HHS Secretary through the OCR breach portal at the same time. If more than 500 of the affected people live in one state or jurisdiction, it must also notify major media outlets serving that area within the same 60 days. Breaches affecting 500 or more individuals are posted publicly on the HHS Breach Portal, commonly known as the Wall of Shame.

What is the HIPAA breach notification timeline?

The HIPAA breach notification timeline under 45 CFR 164.404-408 requires individual notification within 60 calendar days of breach discovery. For breaches affecting 500 or more people, HHS notification must go out at the same time, within 60 days. If more than 500 residents of one state or jurisdiction are affected, media notification is also due within 60 days. For breaches affecting fewer than 500 individuals, HHS notification may be submitted annually no later than 60 days after the end of the calendar year in which the breach was discovered. Business associates must notify the covered entity within 60 days of discovering a breach, and a BAA can set a shorter window. The clock starts at breach discovery, not at the date the breach occurred.

When does HIPAA require compliance with data breach notification rules?

HIPAA requires compliance with data breach notification rules whenever there is an unauthorized acquisition, access, use, or disclosure of unsecured protected health information that compromises the security or privacy of the PHI. Under the Breach Notification Rule (45 CFR 164 Subpart D), covered entities must presume that any impermissible use or disclosure of PHI is a reportable breach unless an exception applies or they can demonstrate through a four-factor risk assessment that there is a low probability the PHI was compromised. The four factors are the nature and extent of PHI involved, who accessed it, whether PHI was actually acquired or viewed, and the extent of risk mitigation applied.

Sources

• 45 CFR Part 164, Subpart D: Breach Notification Rule
• HHS HIPAA Breach Notification Rule
• HHS Breach Reporting Portal
• 45 CFR 164.402: Definitions (Breach, Unsecured PHI)
• 45 CFR 164.404: Individual Notification Requirements
• 45 CFR 164.408: Notification to the Secretary (HHS)

Related Reading

• Okanogan Behavioral Healthcare Breach Settlement
• HIPAA Documentation Requirements
• New HIPAA Security Rule Changes for 2026
• OCR Enforcement: Substance Abuse Clinic Fined $103K
• Florida HIPAA Requirements: State-specific breach notification and compliance rules
• California HIPAA Requirements: CMIA and state breach reporting obligations
• Texas HIPAA Requirements: HB 300 and state-level enforcement