HIPAA business associate breach notification duties explained

What a business associate must do after a HIPAA breach

A business associate that discovers a breach of unsecured protected health information must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, and it must identify each affected individual where it can (45 CFR 164.410). That deadline is the outer limit, not a target. The clock runs from the date the breach is known or should reasonably have been known, so an organization that delays its internal investigation may find the 60 days were already running. The business associate owns this notice. It does not wait for the covered entity to ask, and it does not decide the covered entity's own notification to individuals, regulators or the media.

The answer changes with three variables: the business associate agreement, the subcontractor chain and the discovery date. The contract may require faster reporting or define security incidents more broadly than the regulation does, and the Security Rule already requires business associate contracts to report security incidents, including breaches of unsecured PHI (45 CFR 164.314(a)(2)(i)(C)). If a subcontractor holds the PHI, the subcontractor's notice to you starts the chain, and your own deadline may run from when you learned of it. Confirm with your counsel how each contract defines discovery, who notifies whom and what content the covered entity expects, because these terms decide whether you are on time.

DeployOpen prepares the systems, logs and evidence that make a notice possible: centralized audit records, preserved forensic data, a documented timeline of discovery and a contact map for each covered entity and subcontractor. DeployOpen does not decide whether an event is a reportable breach, does not sign or send notices on your behalf unless your written scope says so, and does not issue reports or attestations. That reportability decision rests with the business associate and its counsel, and any external review of the outcome comes from an independent assessor or the regulator. Ask your implementation partner to confirm in writing which of these tasks sit inside its fixed scope before an incident occurs.

How a business associate moves from discovery to notice

The sequence turns a suspected security event into a documented breach determination, a notice to the covered entity and a clear split of follow-on duties. Each phase ends with a specific record that the business associate can show later.

Log and triage the event on discovery
The business associate's security or incident response team records the event as soon as anyone suspects unauthorized access to, or use or disclosure of, ePHI. The triage record names the systems and data involved, the date and time the business associate first learned of the event, and who is accountable for the file. Discovery matters because the 60-day limit runs from that point, so the timestamp is the first piece of evidence an assessor or the covered entity will ask for. Confirm your contract's definition of discovery and whether it treats knowledge of an agent or subcontractor as your knowledge.
Contain the event and preserve evidence
Responders isolate affected accounts, systems or backups and preserve logs, images and tickets before changing anything. The output is an evidence inventory listing what data may have been accessed, which encryption or access controls were in place, and whether the affected data was unsecured PHI. Containment also tells you whether the event remains active, which affects the scope of later notices. Logs for the affected period should be exported to a system the attacker cannot reach.
Decide whether the event is a breach of unsecured PHI
Counsel or the privacy officer decides whether the event is a breach of unsecured PHI under the Breach Notification Rule, applying the presumption of breach and the statutory exceptions and the four-factor risk assessment. The output is a written determination that states the conclusion, the facts relied on and the reviewer's name and date. If the business associate concludes there is no breach, it should still record the security incident and the reasoning, because the covered entity will rely on that record. Ask your covered entity customers in advance how they want these determinations shared.
Document the four-factor assessment with the covered entity
Where the event may be a breach, the business associate completes the four-factor assessment, covering the nature and extent of the PHI involved, the unauthorized person who used or received it, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. The business associate shares its analysis with the covered entity, which holds the ultimate responsibility for notifying individuals and carries the burden of proof for any decision not to notify. The output is a shared assessment file, with a version history, that both parties can sign off on.
Identify affected individuals and affected records
The business associate builds a list of affected individuals and the records that contain their PHI, using system queries, backup restores and manual review where data is unstructured. The regulation requires the notice to the covered entity to identify each affected individual where the business associate can do so, so this list is the core deliverable of the step. Where some individuals cannot yet be identified, the output should say which records remain unresolved and when the business associate expects to finish the search. Keep the method and query results, since the list will be checked later.
Notify the covered entity in writing
The business associate sends written notice to the covered entity's designated contact without unreasonable delay and no later than 60 calendar days after discovery. The notice should describe the breach, the types of PHI involved, the list of affected individuals or the process for completing it, the mitigation steps taken and the contacts for follow-up. Send it through the channel named in the business associate agreement and keep proof of delivery. Confirm with the covered entity whether it wants early notice of suspected events before the determination is complete.
Cooperate with the covered entity's notices and reports
After notice, the business associate supports the covered entity's decisions on individual notice, media notice, and reporting to HHS, and it carries out any delegated individual notices under the terms agreed in writing. The output is a record of each task handed over, who completed it, the date and the copy of each letter or message sent. Keep this file current, since the covered entity may need it to answer an OCR inquiry, and the business associate is directly liable for its own cooperation with HHS investigations.

Who notifies individuals and what the contract must say

The covered entity keeps ultimate responsibility for notifying affected individuals of a breach of unsecured PHI, even when the breach happened inside a business associate's systems. Handing a vendor the work does not hand over the duty. HHS says the covered entity may delegate those individual notices to its business associate, so the practical question is who sends them, and the covered entity still has to show that its arrangement worked. Its breach policy should record how vendor incidents reach the organization and who decides on notices.

Ultimate responsibility: If a business associate's notices are late or missing, the covered entity answers to HHS and to patients, so monitoring the vendor is part of compliance.
Start of the clock: Your own obligations depend on when you learned of the breach, so record the date a vendor report reached your privacy or security lead.
Documented delegation: Keep a written record of which party sends individual notices and the reasons for that choice.
Vendor readiness: Confirm the business associate can identify affected individuals and produce accurate notice content quickly.

Check your breach policy to confirm who owns each notice step, how vendor reports are escalated, and who signs off before any letter leaves the organization.

Which duties apply to the business associate directly

HHS lists a set of HIPAA provisions that bind business associates in their own right, not only through the contract with the covered entity. The cards below take each provision in turn, state what the business associate must be able to show, and flag where readiness gaps usually sit.

Security Rule compliance

A business associate must comply with the Security Rule for all electronic PHI it creates, receives, maintains or transmits for a covered entity. That means a documented risk analysis, risk management, and written policies covering administrative, physical and technical safeguards. The common gap is a risk analysis that was never performed or never updated after systems changed. Ask for the most recent risk analysis and the date of its last review.

Breach notification to the covered entity

The business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The notice should identify each affected individual where possible. The gap usually sits in the discovery date: teams often start the clock later than the day a workforce member or subcontractor knew of the event. Confirm who receives alerts and how quickly they are routed to the person who makes the notice decision.

Impermissible uses and disclosures

A business associate may use or disclose PHI only as its contract permits or as required by law. Any use or disclosure outside those terms is presumed to be a breach unless a documented risk assessment shows a low probability of compromise. Evidence includes access logs, data flow maps and records of disclosures to other parties. The gap is often in analytics or support tools that copy PHI into systems the contract never named. Check that each such flow appears in the agreement.

Minimum necessary

Business associates must limit PHI uses, disclosures and requests to the minimum necessary to accomplish the intended purpose. For a service provider, this shapes which fields are pulled into test environments, exports and reports. The evidence is a documented data scope for each service and role-based access that matches it. The usual gap is staging or development copies that hold full production records with no business reason. Ask how non-production data is created and masked.

Cooperating with HHS investigations

A business associate must cooperate with HHS when it investigates compliance, including giving access to its books, records and facilities as the Secretary requires. Readiness depends on being able to produce policies, risk analyses, incident records and access logs quickly and in a usable form. Teams that keep evidence scattered across tickets and personal drives often struggle here. Confirm an owner for regulator requests and a current inventory of where compliance records are stored.

Subcontractor business associate agreements

A business associate that passes PHI to a subcontractor must enter a business associate agreement with that subcontractor, and that subcontractor carries the same direct obligations. Cloud hosts, managed service providers and support vendors all fall in this chain. The evidence is a current list of subcontractors that handle PHI, each with a signed agreement on file. The common gap is a vendor who was added for a single feature and never entered the register. Reconcile the register against actual data flows at least once a year.

What OCR enforcement shows about late or missing notice

The two most recent OCR cases tied to business associate breach notice show that late or missing notice is rarely the only failure. In March 2026, OCR settled with MMG Fusion, a software business associate whose system was infiltrated in December 2020. OCR cited a failure to conduct a risk analysis, an impermissible disclosure of PHI affecting about 15 million individuals, and a failure to notify covered entities. MMG paid $10,000 and accepted a three-year corrective action plan. The lesson drawn from this case is that a business associate that never assessed its risks had no reliable basis for detecting the intrusion, judging its scope, or deciding who had to be told. Software vendors should confirm that their risk analysis covers the systems that hold client PHI and that their incident runbook names the person who calls each covered entity.

The May 2025 Vision Upright MRI resolution agreement, a $25,000 settlement, shows the same pattern at a single-site provider. Medical images on a PACS server were accessible over the Internet. OCR found the organization had never conducted a risk analysis and had not notified affected individuals within 60 days. Here the missing risk analysis and the missed notice deadline were both findings, so a team that treats notice as a later step after the technical fix will still be exposed. Ask the question directly: when did we discover the event, who documented that date, and what would a regulator see in our records if it asked for the timeline?

Both cases should prompt a short review of your own contracts and runbooks. Confirm that each business associate agreement requires prompt reporting of security incidents and breaches, that the contractual clock matches the 60-day outer limit in the rule, and that the vendor knows which party will handle individual notices. Check that the risk analysis names every system that stores or transmits PHI, including internet-facing servers and third-party hosted tools. Records of discovery, investigation and notice decisions are what let an organization show OCR it acted within the required time, so have them ready before an incident, not reconstructed afterward. Outside counsel and a qualified assessor can help you test these points, but the organization remains responsible for the findings.

What a business associate needs in place before a breach

A business associate that waits for a breach to find its procedures, logs and contacts will struggle to meet the 60-day clock. The cards below cover the artifacts and relationships that have to exist before an incident, so that discovery, notice and delegation can happen on time. DeployOpen can prepare these systems and evidence, but the organization decides what its procedures say and who signs off on them.

Written incident response and breach procedure

The Security Rule expects a business associate to identify and respond to security incidents and to document both the response and its outcome. The breach procedure should say who declares a suspected breach, who runs the four-factor assessment, who decides on notice to each covered entity, and how the decision is recorded. Check that the procedure names roles rather than individuals only, and that it is tested against a realistic scenario such as a ransomware event on a hosted system. Ask counsel to confirm the procedure matches each covered entity's contract terms.

Current risk analysis

OCR's enforcement record shows that a missing or outdated risk analysis is one of the most frequent findings against business associates. The analysis should map every system where ePHI is created, received, maintained or transmitted, including backups, logs, support tooling and subcontractor-hosted services. A breach response is only as reliable as the inventory behind it, because the assessment cannot judge exposure from systems nobody listed. Confirm the analysis is dated, reviewed after significant changes, and linked to the risk management plan.

Logging that establishes discovery dates

The 60-day period starts on discovery, which for a business associate is tied to when it knew or should reasonably have known of the breach. Logs must therefore be retained, time-synchronized and reviewed well enough to reconstruct when an intrusion began and when staff first saw signs of it. Check that authentication, administrative and data access logs cover every ePHI system, that log retention meets your contract and policy requirements, and that someone can produce a timeline from them quickly. Without this evidence, the discovery date becomes a matter of dispute.

Notification templates and covered entity contacts

Each covered entity has its own contract, contacts and preferred format for breach notice, and the notice must identify affected individuals where possible. Prepare a draft notice template for each covered entity, with fields for the facts known so far, the categories of PHI involved, the steps taken and the contact person. Keep a current contact list with a named primary and backup for each customer, including after-hours numbers, and review it on a regular schedule. Ask each covered entity which party it wants to handle individual notices if it delegates that duty.

Subcontractor agreements in place

A business associate that uses subcontractors that create, receive, maintain or transmit ePHI must have a business associate agreement with each of them, and the subcontractor must report incidents up the chain. Inventory every subcontractor and hosting provider, confirm each agreement includes incident reporting terms, and confirm that reporting deadlines are short enough to leave time for the 60-day notice. Gaps here often surface only after an incident, when the subcontractor's notice arrives late or not at all. Legal counsel should review the terms against the Security Rule provisions on business associate contracts.

Tested contact path and escalation

A breach notice that reaches the covered entity late or through the wrong channel can cause the same problems as no notice at all. Define the escalation path from the security on-call to the privacy officer, legal and the executive who signs notices, and test it with a tabletop exercise that includes a covered entity contact. Record how long each step took and fix the slow ones. Confirm that the path works outside business hours and that a backup contact can act if the primary is unavailable. DeployOpen can run the exercise as part of its security testing work, and the organization owns the results.

What the pending Security Rule would add for business associates

The January 6, 2025 proposed rule (90 FR 898) would add two duties aimed directly at business associates: annual written verification that the business associate's technical safeguards are in place, and notice to the covered entity within 24 hours when the business associate activates its contingency plan. Neither duty applies today. As of October 2026 the rule has not been finalized, and the latest Unified Agenda entry lists final action as projected for July 2027. Treat both items as proposals that could change in wording, scope or timing before they become law.

For a business associate, the practical question is what to prepare now without building to an unsettled text. Ask your counsel to read the proposed rule against your current business associate agreements, since the 24-hour notice would sit alongside the existing 60-day outer limit for breach notice to the covered entity. Identify who on your team could produce a written technical safeguard verification each year, which systems it would cover (for example, the ePHI hosting environment, backups and access logs), and where the evidence for each safeguard already lives. Confirm with your covered entity customers whether they expect any of these terms in your contracts today.

Keep the rule on a standing watch list and review the Federal Register proposal and any final rule when it issues. Current obligations under 45 CFR 164.410 and 164.314 remain the binding standard until that happens. Where a customer asks you to commit to the proposed timelines early, record that as a contract term you have agreed to, not as an existing legal requirement, and confirm the wording with qualified counsel.

Questions business associates ask about breach notice

Does the 60-day limit run from the breach or from discovery?

The 60-day limit runs from discovery, not from the date the breach happened. A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery, and it should identify each affected individual where it can. The clock can start before anyone has finished investigating, so the practical question is when your organization knew, or should reasonably have known, that PHI was involved. Delays in triage, escalation or forensic scoping do not pause the clock. Confirm your internal escalation path, and have counsel review how discovery is defined in your incident procedures and business associate agreement.

Can a covered entity delegate individual breach notices to us?

Yes, the covered entity can delegate individual notices to the business associate, but it stays ultimately responsible for making sure they are sent. HHS says the covered entity should decide which party is best placed to notify, for example the one that has the relationship with the affected individuals. Delegation is a contract and operations question. The agreement should state who drafts the notices, who approves them, who pays for mailing and call center support, and who answers individual questions. Your staff or an outside partner can prepare the mailing workflow and evidence, but the decision about who notifies, and the content of the notices, belongs to the covered entity and its counsel.

What if our contract requires notice faster than 60 days?

A shorter contractual deadline binds you in addition to the federal rule, and the stricter term is the one you must plan around. The Security Rule requires business associate contracts to require reporting of security incidents, including breaches of unsecured PHI under 45 CFR 164.410. Many covered entities write shorter windows into their agreements, so the contract, not the regulation's outer limit, often sets your actual deadline. Check each agreement for the trigger (discovery, suspicion or confirmation), the content of the notice, and any follow-up reporting dates. Your legal team should map these terms into the incident runbook, because a missed contractual deadline can create a breach of contract even when the federal deadline is met.

Does a breach at our subcontractor count as our breach?

A subcontractor incident is handled through your chain of agreements, and you carry duties for it. Business associates must enter business associate agreements with their subcontractors, and HHS lists that duty among the provisions for which business associates are directly liable. Whether a subcontractor event becomes a breach you must report depends on the facts of the event and the terms of your subcontractor agreement, which should require the subcontractor to report to you promptly. Confirm that each subcontractor contract carries a reporting term that lets you meet your own deadline to the covered entity. Your counsel should decide how an event at a subcontractor is attributed and documented.

What can an outside partner handle, and what must our staff own?

An outside partner can prepare evidence and technical work, while your organization keeps the legal and decision duties. Typically a partner can help with log collection, forensic preparation, system hardening after an incident, documentation of timelines, and building the notice mailing workflow. Your staff, or your counsel, should own the reportability decision, the content of notices to the covered entity, the signed agreements, and any statements to regulators. Only the organization and its counsel decide legal obligations. Ask any partner to put its role, deliverables and handoff points in writing before an incident, so responsibilities are clear under pressure.

Can an implementation partner decide whether an event is reportable?

No. An implementation partner can support the facts, but it cannot decide whether an event is a reportable breach. Deciding whether an impermissible use or disclosure is a breach, and whether notice is due, is a legal determination made by the covered entity or business associate with its counsel. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms and runs security testing, and it prepares systems and evidence for assessments. It does not issue legal opinions or audit reports. Before an incident, agree on who makes the call, what records the partner will keep, and how those records will reach counsel.

What happens to business associates whose notice came too late?

A late notice can lead to direct enforcement against the business associate, not only the covered entity. HHS lists breach notification to the covered entity among the HIPAA provisions business associates are directly liable for. OCR's settlement with MMG Fusion, a software business associate, cited among other things a failure to notify covered entities, and MMG paid $10,000 and accepted a three-year corrective action plan. The settlement also cited a failure to conduct a risk analysis. Key drivers of exposure include when discovery is documented, how quickly the covered entity is told, and whether the incident record shows reasonable diligence. Ask counsel to review your notice timeline against the contract and rule before an incident occurs.

How DeployOpen prepares business associate breach evidence

DeployOpen helps business associates prepare the systems, logs, contracts and records they need to detect, document and report a breach of unsecured PHI to the covered entity on time. We plan, implement and document the open-source platforms that hold ePHI inside your own infrastructure, while your organization keeps ownership of its decisions, notices and obligations.

How we scope

Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
The written scope lists which ePHI systems, logs and business associate agreements are covered for breach reporting.
Scope also names who owns each decision, including who decides on notifying covered entities and individuals.
We confirm with you which contract terms, reporting paths and discovery triggers your agreements already set.

How we build

We implement centralized audit logging on self-hosted platforms so discovery times can be reconstructed from records.
We set up alerting and an incident record template that captures dates, affected systems and individuals affected.
We test detection and reporting workflows with tabletop exercises and security testing against agreed scope.
We document how the four-factor risk assessment inputs are gathered, so your team can apply the analysis itself.

How we hand over

You receive runbooks for notifying covered entities, including the 60-day outer limit and the content each notice should include.
Documentation covers system diagrams, logging coverage, retention settings and named responsibilities for each step.
We walk your staff through the evidence pack so they can produce it for a covered entity or an OCR inquiry.
Handover records state what was tested, what was changed and which gaps remain open for your decision.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can keep logging, backups and incident runbooks current as your platforms and contracts change.
We can re-test reporting workflows after material changes to systems, subcontractors or covered entity agreements.
Your counsel and any independent assessor remain responsible for legal conclusions and any formal attestation.

HIPAA business associate breach notification duties