HIPAA breach notification deadlines: who to notify and when

Who must be notified after a HIPAA breach, and by when

When a breach of unsecured PHI is discovered, a covered entity must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovery. The HHS Secretary must also be told: contemporaneously with individual notice for breaches affecting 500 or more individuals, and through the annual log for breaches affecting fewer than 500. Those two numbers set the clock, so the first task after discovery is to fix the discovery date and the affected count, both of which can change as the investigation proceeds.

Discovery timing matters because a breach counts as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it. An agent's knowledge can start the clock, so the incident log should record when each system owner, help desk team and business associate first flagged the problem. The affected count also drives other duties. A breach involving more than 500 residents of a state or jurisdiction requires notice to prominent media outlets serving that area within the same 60-day limit, and out-of-date contact details for 10 or more individuals trigger substitute notice. Confirm each state's residency figures early, since a count that crosses 500 changes the media and HHS obligations at once.

The organization owns every one of these notices, the decision to send them, and their content. An implementation partner can prepare the systems and evidence that support them: audit logs that show when access occurred, data maps that identify which records were unsecured PHI, contact data that can be checked for substitute notice, and a documented timeline of discovery. Any role that prepares this material does not sign or issue the notices, and HHS does not accept an outside provider's sign-off in place of the covered entity's own filing. Before an incident, ask who will decide on notice, who holds the HHS portal credentials, and whether counsel reviews the content.

Notice recipients and their triggers

A breach of unsecured PHI can trigger notice to up to four audiences, and each one has its own threshold and clock. Map every affected individual, count the residents in each state, and sort the breach by size before the 60-day limit starts running.

Affected individuals

Every individual whose unsecured PHI was involved in the breach must receive written notice without unreasonable delay and no later than 60 calendar days after discovery. The clock starts on the first day the breach is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who caused it. Notice goes by first-class mail, or by email only if the individual agreed to electronic notice. Check the discovery date in your incident log first, because it sets the deadline for every other notice.

Substitute notice

If contact information is out of date for 10 or more individuals, the covered entity must give substitute notice. Options are a conspicuous link on the website home page for 90 days or notice in major print or broadcast media. A toll-free number must stay active for at least 90 days so individuals can ask whether they were affected. Confirm current addresses before the notice run, and keep a record of each substitute method used.

Prominent media outlets

A breach affecting more than 500 residents of a state or jurisdiction requires notice to prominent media outlets serving that area. The notice must also fall within the 60-day limit. Count residents by state or jurisdiction, not only by total breach size, since a breach can cross this line in one state while staying below it overall. Coordinate the press release with the individual notices so the wording matches.

HHS Secretary

Breaches affecting 500 or more individuals must be reported to the HHS Secretary at the same time as individual notice. Breaches affecting fewer than 500 individuals are logged and reported no later than 60 days after the end of the calendar year in which they were discovered. Keep a breach log from the start, because the annual report for smaller breaches depends on it. Confirm the reporting method with OCR's current portal instructions before filing.

FTC for personal health record vendors

Vendors of personal health records and their third-party service providers fall under breach notification rules enforced by the Federal Trade Commission, not HHS, under section 13407 of the HITECH Act. An entity that is not a HIPAA covered entity or business associate should confirm which regime applies before it sends any notice. Dual status can require both sets of notices, so review contracts and service roles early.

How the notification timeline runs from discovery

The sequence turns a suspected exposure of unsecured PHI into a documented decision, timely notices to the people and entities the rule names, and a record that shows each step was handled on time.

Record the date of discovery
Start the clock on the day the breach is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who caused it. The incident lead records who first knew, what they knew and when, in the incident log. The output is a discovery memo with dates and times that counsel can rely on. Ask counsel to confirm how your agents' knowledge is attributed to you, since agency is decided on the facts.
Assess the breach and scope the affected individuals
Confirm that the exposure involved unsecured PHI, then work out which records, which individuals and which states or jurisdictions are involved. Your team, with forensic support and counsel, runs the risk assessment and identifies residency counts and current mailing or email contact data. The output is a named list of affected individuals, a count of residents per state, and a written conclusion on whether notification is required. Each conclusion needs a documented basis.
Draft the individual notice content
Write the notice in plain language so that it covers what happened, the discovery and breach dates, the types of unsecured PHI involved, steps individuals should take, what you are doing to investigate, mitigate and prevent recurrence, and how to get answers. Include a toll-free number, email address, website or postal address for questions. The output is an approved template reviewed by privacy counsel and, where you use one, the business associate that holds the data.
Send individual notice and substitute notice
Mail each notice by first-class mail, or by email only where the individual has agreed to electronic notice. Send without unreasonable delay and no later than 60 calendar days after discovery. Where contact details are out of date for 10 or more people, post substitute notice on the website home page for 90 days or use major print or broadcast media, and keep a toll-free number active for at least 90 days. The output is a mailing log with dates, return mail handling and proof of the substitute notice.
Issue media notice where the threshold applies
If a breach involves more than 500 residents of a state or jurisdiction, notify prominent media outlets serving that area within the same 60-day limit. The notice carries the same content as the individual notice. The output is a copy of the press notice, the outlets it went to and the date of release. Confirm whether your state adds its own media or regulator requirements with counsel, since those are outside this federal rule.
File the HHS report or log the smaller breach
For breaches affecting 500 or more individuals, report to the HHS Secretary at the same time as individual notice. For breaches under 500, add the entry to your breach log and report it no later than 60 days after the end of the calendar year in which it was discovered. The output is an HHS submission receipt or a dated log entry tied to the discovery memo. Keep the portal confirmation with the incident file.
Retain the documentation for the record
Keep the discovery memo, risk assessment, notice templates as sent, mailing and substitute notice records, media notice, HHS confirmation and the sanctions or retraining decisions for workforce members who did not follow policy. Your written breach policies and training records belong in the same file. The output is a closed incident file that an OCR investigator could follow from discovery to notice. Ask counsel how long to retain the file, since the rule's retention periods for this material should be confirmed with them.

How the duties change by situation

When a breach of unsecured PHI affects fewer than 500 individuals, the covered entity still notifies each affected individual without unreasonable delay and within 60 calendar days of discovery. The difference lies in regulator reporting. Smaller breaches are not reported to the HHS Secretary at the time of discovery. Instead, the entity logs them and reports them to HHS no later than 60 days after the end of the calendar year in which they were discovered.

Individuals: Written notice to each affected person by first-class mail, or by email if the individual has agreed to electronic notice.
HHS: No contemporaneous report. The breach goes on an annual log submitted after the calendar year ends.
Timing: Individual notice runs from the discovery date, while the HHS log deadline runs from the end of the discovery year.
Record kept: A log entry for each breach, with the date of discovery, the number affected, the notices sent and the annual submission.
Documentation: The breach risk assessment and the policy steps that led to the decision.

Confirm with counsel which calendar year governs each log entry, and keep the log current throughout the year so the annual submission is not assembled from memory.

What written policies and training must exist before a breach

Before a breach happens, a covered entity must already have written breach notification policies and procedures, must have trained its workforce on them, and must have a sanctions process for workforce members who do not follow them. HHS states these expectations directly on its Breach Notification Rule page, and they are the first things an OCR investigator asks for after a reported incident. The organization owns these documents. Its privacy official and leadership must approve them, and the approval date and version history should be recorded so the documents can be shown as the ones in force at the time of the incident.

An assessor or OCR investigator will typically ask for the written policy set, evidence that it was approved and reviewed, the procedure for discovering and escalating a suspected breach, the decision steps for the four-factor risk assessment, the notification letter and media templates, and the process for tracking the 60-day clock. They will also ask for training records showing who was trained, when, on which version, and what was covered, plus records of any sanctions applied. Confirm with counsel which state breach laws add their own notice duties, because those are not covered by the federal rule and need their own procedures.

An implementation partner can draft templates, build a training curriculum, schedule and run tabletop exercises that walk staff through a breach scenario, and collect and organize the training and exercise records. None of this transfers accountability. The covered entity must review and adopt the final documents, decide who the breach response team is, and sign off on the sanctions policy. A tabletop exercise shows that people know their roles, but it does not prove the policy was followed in a real event, so the record of what the team actually did during an incident matters just as much.

What to have in place before a breach happens

Breach notification depends on work done long before anything goes wrong. The six items below are the pieces an entity needs ready so it can notify individuals, the media and HHS within the required deadlines, and each one can be checked now against a short, concrete test.

Current contact data for every individual

Notice goes to each affected person by first-class mail, or by email only if the individual agreed to electronic notice. Check that patient and member addresses, email addresses and agreements to receive email are current in the systems that will feed the notice list, and that records for former patients and dependents are included. Ask whether a returned-mail process updates the record, because undeliverable addresses trigger substitute notice once they reach 10 or more individuals.

A notice template with required content

Prepare a plain-language template that already contains every element the rule requires: what happened and the discovery date, the types of unsecured PHI involved, steps individuals should take, what the entity is doing to investigate and prevent recurrence, and a toll-free number, email address, website or postal address for questions. Have counsel review it in advance, and test that each field can be filled from the incident record without delay.

A toll-free line and web page for substitute notice

Substitute notice requires a website home page notice for 90 days or major print or broadcast media, plus a toll-free number that stays active for at least 90 days. Confirm that the call center contract, phone number, scripts and hosting can be activated within hours, not weeks, and that the web page can be published on the home page without a long change request. Ask the vendor who can switch these on at 2 a.m. on a Saturday.

A discovery log with timestamps

Discovery starts the clock on the first day a breach is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who caused it. Keep an incident log that records when each alert, report or observation was received, who received it and what was done. Review it after each incident to confirm the discovery date is defensible, since regulators will ask for it first.

A media contact list for each state served

A breach involving more than 500 residents of a state or jurisdiction requires notice to prominent media outlets serving that area, within the same 60-day limit. Build a list by state and metropolitan region from where your patients or members live, not where your headquarters sits. Verify each outlet's contact route and the name of a person who handles health news, and rerun the list when service areas change.

An HHS portal account and annual log process

Breaches affecting 500 or more individuals are reported to the HHS Secretary at the same time as individual notice. Smaller breaches are logged and reported no later than 60 days after the end of the calendar year in which they were discovered. Confirm that a named person holds a working login to the HHS breach portal before an incident occurs, and that an annual task exists to file the smaller-breach log, with owners and reminders assigned.

Business associates and the FTC rule for health record vendors

A business associate that discovers a breach of unsecured PHI must notify the covered entity it works for, and the covered entity usually carries the duty to notify affected individuals, the media where required and HHS. The business associate's contract is where this split is set, so the first check is the business associate agreement: confirm the deadline for reporting to the covered entity, what the report must contain, and whether the business associate is delegated to send individual notices on the covered entity's behalf. If the contract does not delegate notice, the covered entity sends it, and the business associate's job is to supply accurate identities, contact details and facts fast enough that the covered entity can meet its own 60-day limit. Covered entities should also confirm who pays for mailing, call center and credit monitoring costs, because those terms are negotiated, not set by the rule. For the duties that fall on the business associate itself, the next read is the HIPAA business associate breach notification duties page, which covers the discovery clock and direct liability in detail.

A separate notification regime applies to some vendors outside HIPAA. Under section 13407 of the HITECH Act, the Federal Trade Commission enforces breach notification duties on vendors of personal health records and on their third-party service providers. This applies to consumer health apps and similar products that hold health information but are not covered entities or business associates. Whether a product is a personal health record vendor, a business associate or neither depends on who it serves and on whether it acts for a covered entity, so a vendor should document that determination before a breach occurs. Teams building or hosting such products should confirm with counsel which regulator applies to each data flow and keep both sets of notification procedures in the same incident runbook.

Assessing a vendor's readiness is a practical step that does not require waiting for an incident. Ask each business associate and each subcontractor for its written breach notification procedure, its named contact for incident reports, and evidence that staff have been trained on it, which HHS states covered entities must also have. Test the chain once a year with a tabletop exercise that starts with a vendor reporting a breach and ends with the covered entity's notices, so that gaps in timing, content and contact details surface before a real event.

Breach notification questions buyers ask

Can a covered entity notify individuals of a breach without a documented risk assessment?

Yes, a covered entity can choose to notify without completing a formal risk assessment, because the Breach Notification Rule presumes an impermissible use or disclosure is a breach unless the entity demonstrates a low probability that PHI was compromised. Notifying without an assessment is a legitimate choice when the facts are clear, but it does not replace the need to document how the entity reached its conclusion. Whether a specific incident is reportable depends on the four-factor test and the exceptions, which are covered in the sibling topic on the breach risk assessment. Confirm your approach with privacy counsel before relying on it.

When does the 60-day breach notification clock start?

The clock starts on the first day the breach is known, or would have been known with reasonable diligence, to any workforce member or agent of the covered entity other than the person who committed the breach. Under 45 CFR 164.404, the 60 calendar days run from that discovery date, not from the date the investigation concludes. Organizations should record when each person first had knowledge, because that record will be tested if notice is late. Notice must still go out without unreasonable delay, so the 60-day limit is an outer boundary rather than a target.

Does encryption of the data remove the duty to notify?

Encryption can remove the notification duty only when the data is secured under HHS guidance and the protective measure is applied to the PHI involved in the incident. If the PHI was unsecured, such as data in plaintext or where the keys were also exposed, the breach notification obligations apply. The conditions for treating encryption and destruction as a safe harbor are covered in the sibling topic on the breach risk assessment, so review that page and your encryption records before deciding. Document the state of the data at the time of the incident, not only the policy that says it should have been encrypted.

Who pays for individual notices, media notices and call center work?

The covered entity pays for its own breach response, including mailing notices, substitute notice, toll-free lines and any credit monitoring it chooses to offer, because the legal duty to notify sits with the covered entity. A business associate that handles notices on the covered entity's behalf is usually paid under the business associate agreement, so the contract should state who bears each cost. Costs rise with the number of affected individuals, the state of contact data, the number of languages and the length of the call center period. Ask any vendor for an itemized quote covering printing, postage, data handling, call center hours and reporting, and confirm which items are one-time and which recur.

Can an implementation partner send breach notices on our behalf?

An implementation partner can help draft notice content, prepare contact lists, configure notification workflows and document the response, but the covered entity owns the notices and the legal obligation. DeployOpen plans, implements and documents systems inside your own infrastructure and prepares evidence; it does not act as your legal notifier or issue reports on your behalf. Decide in advance who signs and sends each notice, who approves wording and how the organization keeps records. If a third party sends notices, that arrangement must be set out in writing in the contract and reviewed by counsel.

How do we confirm state breach notification timing with counsel?

Ask counsel to map every state where affected individuals live, because state breach laws can set shorter deadlines, different content rules and separate regulator notices that run alongside HIPAA. A HIPAA deadline of 60 calendar days does not guarantee compliance with a state law that may require faster notice or an attorney general filing. Give counsel the discovery timeline, the list of affected residents by state and the data elements involved, and ask for a written calendar of deadlines. Revisit that calendar whenever the affected population changes.

What should a breach notice to individuals contain?

A breach notice must describe in plain language what happened, the discovery date, the types of unsecured PHI involved, the steps individuals should take, what the entity is doing to investigate and mitigate harm, and contact procedures including a toll-free number, email address, website or postal address. Keep the wording factual, avoid speculation about the attacker and have counsel review drafts before mailing. Check each element against the requirement in 45 CFR 164.404(c) before the notice goes out.

How DeployOpen works on this

DeployOpen helps organizations prepare the logging, contacts, templates and written procedures that breach notification depends on, inside the client's own infrastructure. The organization owns its breach determinations and notices, and only the organization decides who to notify and when.

How we scope

The written scope lists which systems hold ePHI, which logs feed breach investigations, and which teams own each notice step.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
The scope names who in your organization approves notices, and which business associates must be contacted under your contracts.

How we build

We configure self-hosted logging and audit trails so you can establish when a breach was discovered and what data was involved.
We draft notice templates covering required content, substitute notice and media notice triggers, for your legal counsel to review.
We test the notice workflow with a tabletop exercise, recording gaps in contact lists, approvals and the 60-day clock tracking.

How we hand over

You receive documented procedures, runbooks and a notice readiness register that your privacy and security officers can maintain.
Evidence packages include log configurations, test records and training records for workforce members on breach notification policies.
Handover covers what remains your responsibility, including breach risk determinations, HHS reporting decisions and any legal review.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can keep logging, contact lists and notice templates current as systems and business associate relationships change.
Confirm with DeployOpen during scoping which retainer covers periodic exercises and updates to your written policies.

HIPAA breach notification requirements: who to notify and when