Reporting a HIPAA breach to HHS: OCR portal and deadlines

How do you report a HIPAA breach to HHS through the OCR portal?

Once an incident is confirmed as a breach of unsecured PHI, a covered entity reports it to the HHS Secretary through OCR's online breach portal. Breaches affecting 500 or more individuals are reported at the same time as individual notice. Breaches affecting fewer than 500 individuals are logged and reported no later than 60 days after the end of the calendar year in which they were discovered, although HHS says they may be reported as soon as they are discovered. The count of affected individuals, the discovery date, whether a business associate was involved and whether the count is still uncertain all determine which path applies and what goes into the filing.

The organization owns the reporting decision and the records behind it. That includes the affected-individual count, the discovery date, the risk assessment or exception that supports the call, and the copy of each notice sent. Under the burden of proof in 45 CFR 164.414, these records must show that required notices were made or that notice was not required. DeployOpen can prepare that documentation and evidence for the filing, and can run a readiness check on the counts and dates before anyone submits, but it does not file on the organization's behalf unless it is the business associate filing for a covered entity. No third party issues an HHS acknowledgment as a compliance finding. The portal receipt confirms a submission was received, not that the response was adequate.

Before filing, confirm three things with your privacy officer and counsel: whether the count is an estimate that must be updated later, which transaction number you will need if you file an addendum, and whether each incident needs its own separate notice. The HHS breach reporting guidance sets out the portal steps and should be read alongside the current eCFR text. Keep a copy of every submission and every addendum with the incident file, because a breach report is often the first document an OCR investigator reviews.

How the 500-individual threshold sets your reporting clock

Six inputs decide when and how a breach reaches the HHS Secretary. Record each one at discovery and update it as the investigation proceeds, because the count and the reporting path can change after the first notice goes out.

Count of affected individuals

The number of individuals whose unsecured PHI was involved decides which path applies. At 500 or more, the breach is reported to the HHS Secretary at the same time individual notice is sent. Below 500, it is logged and reported on the annual schedule. Record the count per incident, with the method used to reach it, so the decision can be defended later. If the count sits near the threshold, document both the working figure and the reason it may change.

Date of discovery

The discovery date anchors the timing you must meet. For breaches under 500 individuals, the annual deadline runs from the end of the calendar year in which the breach was discovered, so a breach found in December and one found in January fall into different reporting years. Record the date the breach was known or should reasonably have been known, along with the internal log entry that shows when that happened.

Final count or estimate

If the number of affected individuals is still uncertain, the portal accepts an estimate. Mark the figure as an estimate, state what is still being investigated, and set an internal date to confirm the final number. Once the count is known, file an addendum using the transaction number from the original report. Keep the estimate and the addendum together so the history of changes is visible to OCR.

One incident or several

Each breach incident needs its own notice, so a single investigation that uncovers separate events cannot be reported as one submission. Record each incident with its own date of discovery, count and affected data set. Grouping unrelated events together can misstate the counts that determine the reporting path for each one.

Unsecured PHI involved

The reporting duty applies to unsecured PHI. If the data was encrypted or destroyed in a way that meets HHS guidance, and the key or method was not compromised, the event may fall outside the breach rules. Record the encryption status, the key custody and the evidence for each data set involved. Without that record, you cannot show that the safe harbor applied, and the burden of proof sits with you.

Business associate discovery

When a business associate discovers the breach, the covered entity still carries the reporting duty to the HHS Secretary, but the business associate may submit the report on the covered entity's behalf. Record which party discovered the breach, when it notified the covered entity, and who holds the submission. Clear contract terms and shared records prevent two parties from filing conflicting reports for the same incident.

Filing a breach report in the OCR portal, step by step

This sequence takes a confirmed breach from internal facts to a filed notice on the HHS breach portal, with a transaction number and an internal file that together support any later estimate or addendum.

Confirm the breach and fix the discovery date
Before anyone opens the portal, the privacy or compliance lead confirms that an impermissible use or disclosure of unsecured PHI is a breach, usually by completing the documented risk assessment. Record the date the incident was discovered, the facts relied on, and who approved the decision. The output is a signed breach determination memo kept in the incident file, which shows the reporting clock was assessed and that notice was required.
Count the affected individuals
The privacy lead, with input from the security and records teams, counts the individuals whose unsecured PHI was involved and notes which of them are residents of the same state or jurisdiction. This count sets the reporting path: 500 or more individuals requires contemporaneous notice to the HHS Secretary, while fewer than 500 is logged for annual reporting or may be reported earlier. The output is a counted list with a method note, so the figure can be defended if OCR asks how it was reached.
Decide whether to use an estimate
If the exact number of affected individuals cannot be established yet, the team decides whether to submit an estimate on the initial notice. The reader should confirm with HHS how the portal labels estimates and whether the estimate field is available for the chosen breach type. The output is a written decision, with the basis for the estimate, filed with the incident record so the figure can be updated later.
Open the portal and start a separate notice
A person with access to the OCR breach portal opens a new breach report and completes the fields for the covered entity or business associate, the breach dates, the discovery date and the type of breach and location of the PHI. Each breach incident requires its own notice, so unrelated events must not be combined into one submission. The check at this stage is that the entered dates and counts match the internal memo, and the output is a draft notice ready for review.
Describe the breach and submit
The team enters the narrative and safeguards information the portal asks for, has a second reviewer compare each field with the incident file, and then submits. A business associate reporting for a covered entity should confirm the portal lets it identify the covered entity on whose behalf it files, as HHS allows. The output is a submission confirmation, and the team should save a copy of every field as submitted.
Record the transaction number
After submission, the portal issues a transaction number for the report. The privacy lead records it in the incident file, the breach log and the notification record kept for individual, media and HHS notices, and links it to the internal case number. The check is that the transaction number appears in all three locations, because it is the reference needed for any addendum or later correspondence with OCR.
File an addendum when facts change
When the count changes, new affected individuals are identified, or the facts in the original report are corrected, the team files an addendum to the earlier report using its transaction number rather than opening a new notice. Each addendum and its reason are added to the incident file. Confirm with HHS the current addendum steps in the portal before filing, since fields and screens can change.
Retain the report and the burden of proof file
The team keeps the submitted notice, the transaction number history, any addenda, the risk assessment and the proof of individual and media notices in one retrievable file. Covered entities and business associates carry the burden of showing that required notifications were made or that notice was not required, so this file is the evidence. The output is a complete incident file that could be produced on request by OCR.

What belongs in the report, and when to file an addendum

Each breach incident needs its own notice to the HHS Secretary, submitted through OCR's online breach portal, so a single report should describe one incident only. When the number of affected individuals is still uncertain at filing time, the portal accepts an estimate. The compliance lead should record how the estimate was reached, such as the number of records in the affected database, the date range of access and the sources still under review, so the figure can be explained later. Once the investigation narrows the count, the organization files an addendum that references the original transaction number. The addendum should replace the estimate with the confirmed figure and correct any other field that has changed, such as the date of discovery, the systems involved or the notices already sent. Confirm the current field list on the portal before filing, because the form may change between submissions.

The organization, not an independent assessor, owns everything entered in the portal. An auditor, consultant or implementation partner may help assemble the facts, but none of them reviews, approves or certifies the submission, and HHS does not treat a third-party review as proof that a report was accurate or complete. The person who signs off on the content should be named in the incident response plan, and that person should check each entry against the incident record before submission.

The burden of proof sits with the covered entity or business associate. The documentation that shows the outcome matters as much as the report itself. For every incident, keep copies of each notification sent to individuals, the media and HHS, along with the dates and transaction numbers. Where the organization concluded that notice was not required, keep the written risk assessment, the analysis of the four factors and any exception relied upon. Store these records with the incident file and retain them for the period your policies set under the documentation standard in 45 CFR 164.316. A breach list entry may show that something was reported, but only your own file can show why nothing else was needed.

Who files the report when a business associate is involved

When the covered entity finds the breach in its own systems, it owns the whole reporting chain. It decides whether the event is a breach of unsecured PHI, notifies affected individuals, makes any media notice that applies, and reports to the HHS Secretary through OCR's online breach portal. The timing depends on the count of affected individuals: breaches of 500 or more are reported contemporaneously with individual notice, and smaller breaches are logged and reported no later than 60 days after the end of the calendar year of discovery. Because HHS allows smaller breaches to be reported as soon as they are discovered, many organizations file early and avoid carrying open items into year end.

Filer: The covered entity's privacy or security official, or a delegate it names, submits the portal notice in its own name.
Evidence kept: The discovery date, the risk assessment or exception relied on, copies of every individual, media and HHS notice, and the portal transaction number.
Addenda and estimates: Use an estimate if the affected count is uncertain, then file an addendum under the transaction number as facts firm up.
Separate notices: Each breach incident needs its own notice, so do not combine unrelated events in one submission.
Burden of proof: Keep the documentation that shows notice was made or that the event was not reportable, since the entity carries that burden.

Confirm with your compliance counsel which internal officer signs the portal submission and how the file is stored for the required period.

File early or wait for year end: choosing timing for smaller breaches

This table compares the two timing options for breaches affecting fewer than 500 individuals: filing as soon as the breach is discovered, or logging it and filing in the annual batch. Read each column to see when the option fits, what records you must hold, and how the public record and OCR follow-up are affected. The main takeaway is that either option is permitted, but the choice should match how well your team keeps its breach log and investigation records.

Factor	File on discovery	Log and file in the annual batch
Deadline	No fixed date. HHS says these breaches may be reported as soon as they are discovered.	No later than 60 days after the end of the calendar year in which the breach was discovered.
When it fits	A team with a stable intake process, a clear view of the affected records and a named owner for the report.	A team still investigating scope, or one whose breach log and sign-off steps are not yet reliable enough to support an early filing.
What you must keep	Your investigation file, the risk assessment or exception record, and the portal transaction number for any addendum.	A breach log entry for each incident, the dated risk assessment, and proof of the individual notices sent.
Addenda and estimates	Use an estimate if the count is uncertain, then file an addendum with the transaction number as facts firm up.	Confirm the final count before the batch filing, since the batch report is the first formal record of the breach.
Public record	The entry appears on HHS's public list only if it reaches 500 or more individuals, so a smaller breach stays off that list either way.	The same rule applies. Filing timing does not add or remove a smaller breach from the public list.
OCR follow-up	An early report gives OCR a dated record of your response, which can help if an investigation opens later.	A later report leaves a gap between discovery and filing that OCR may ask you to explain during an investigation.
Burden of proof	Keep the same documents either way. Both options require proof that notice was given or that notice was not required.	Keep the log current throughout the year. Missing entries are hard to rebuild when the batch deadline arrives.
Question to confirm	Ask your counsel whether a stable process supports early filing before you commit to that approach.	Confirm the calendar-year discovery date with your privacy officer and record it in the log at the time of discovery.

How breach reports start OCR investigations and the public breach list

A breach report is often the event that starts an OCR investigation, so the filing should be treated as the opening document of a potential enforcement case, not a closing administrative step. The OSF HealthCare resolution agreement shows how this works: OCR opened its investigation after a 2021 breach report on a ransomware attack affecting 53,907 patients, and the resulting findings cited a failure to conduct an accurate and thorough risk analysis. The lesson for your team is that the content of the report, especially the description of what happened and which systems held ePHI, will be read against what your own records show about your safeguards at the time of the incident.

HHS publishes a list of breaches of unsecured PHI affecting 500 or more individuals, so a filing for a large breach becomes visible to the public once it is processed. Your organization's description of the breach, the number of individuals and the type of breach should therefore be accurate and consistent with any media statements, individual notices and later addenda. Before you submit, confirm that the number of affected individuals matches the notice letters you mailed and the records in your incident file. If the count is still uncertain, use an estimate and plan to file an addendum rather than guessing at a figure that later has to be corrected in public.

Keep your HIPAA risk analysis current before you file, because an investigator who receives a breach report will ask for it first. Confirm that the most recent analysis covers the system involved in the incident, that it lists where that ePHI is stored and how it moves, and that the risk management plan records the decisions made about the threats it identified. If the analysis is out of date or does not mention the affected system, you will likely face questions about it during the investigation regardless of how well the incident was handled. A current analysis also helps you describe the breach accurately and quickly, which reduces the risk that the public record and your own file disagree.

Reporting mistakes that trigger follow-up from OCR

Most OCR follow-up on breach reports traces back to a small set of filing errors: wrong counts, bundled or missing reports, unmanaged small-breach logs, unclear business associate roles, and undocumented judgments. Each card below names one error, how to avoid it, and the record that shows your reasoning if OCR asks.

Miscounting affected individuals

The 500-individual line decides whether a breach is reported contemporaneously with individual notice or logged for the annual report. Count unique individuals across every system, file and vendor involved, not records or files, because one person can appear in several. If the number is still uncertain when you file, the portal accepts an estimate. Keep the query, export or method you used to reach the count, and note who approved it.

Bundling separate incidents into one report

HHS requires each breach incident to have its own notice. Combining two unrelated events, such as a misdirected mailing and a stolen laptop, into one submission makes the record hard to investigate and can misstate counts for each. Give each incident its own internal reference and link it to the portal submission. Keep the discovery date, the incident scope and the notice you filed for each one separately.

Waiting for year end without a log

Breaches affecting fewer than 500 individuals may be reported as soon as they are discovered, but many organizations hold them until the annual deadline and then cannot reconstruct what happened. Maintain a running breach log from the day of discovery with the date, the number affected and the notice status. Confirm the log with your privacy officer before the year-end submission so the annual filing matches what your records show.

Leaving out the business associate's role

When a business associate discovers the breach, it may submit the report on the covered entity's behalf, but the covered entity still owns the notice. Filings that name the wrong entity, omit the vendor or leave out who performed the notifications create gaps OCR will ask about. Confirm in your business associate agreement who reports, who notifies individuals and who supplies the facts. Record the vendor's written confirmation of the discovery date and its submission.

Filing without the risk assessment on file

A report tells OCR that a breach occurred, but the file must also show why you concluded that notice was required, or why an exception applied. Covered entities and business associates carry the burden of proving that required notices were made or that no breach occurred. Before filing, save the four-factor risk assessment, the evidence behind each factor and the approval record. Store it with the notices so both sit together in any later review.

Never filing an addendum after facts change

Counts, causes and recovery steps often change after the first submission, especially when an estimate was filed. Leaving the original report unchanged means the public record and OCR's file can contradict what you later learned. Use the transaction number from the first submission to file an addendum when facts change. Keep a dated version history showing each update, who made it and the source of the new information.

Questions buyers ask before filing an HHS breach report

Can a third party file a HIPAA breach report with HHS for us?

Yes, but only in a specific way: a business associate may submit a breach report on behalf of a covered entity, according to HHS. The covered entity still owns the obligation. Before anyone files for you, agree in writing who submits, who reviews the content, who holds the transaction number and who answers HHS follow-up. Confirm with counsel which party is the reporting entity in your contracts, because the business associate agreement and the facts of the incident determine who must act. An outside consultant can prepare the material, but a consultant is not a substitute for the covered entity's own accountability.

How long does a breach report take to prepare, and what does it depend on?

The filing itself is an online submission through OCR's breach portal, so the time is driven by the facts, not the form. The main variables are how well the incident is documented, how many individuals are affected and whether the count is still uncertain. HHS allows an estimate when the number of affected individuals is unknown, and an addendum can update an earlier report using its transaction number, so you do not need a complete picture to start. Confirm with counsel which deadlines apply to your specific breach, since the timing rules differ for breaches of 500 or more individuals and for smaller breaches.

What information must our team supply before a report can be filed?

Expect to supply the facts that the portal asks for and the evidence that supports them. In practice this means:

The date the breach occurred and the date it was discovered
The approximate number of affected individuals, or an estimate with its basis
The type of breach, the location of the information and the safeguards involved
A summary of the notices sent to individuals, and any media or substitute notice
The risk assessment or exception analysis that shows why the event was or was not a reportable breach

Keep these records, because covered entities and business associates bear the burden of showing that required notifications were made or that the event was not a breach.

Can we file the HHS breach report ourselves without outside help?

Yes. The OCR breach portal is designed for covered entities and business associates to file directly, and HHS publishes the reporting guidance. What outside help usually adds is speed and judgment on the parts that are hard to get right, such as the risk assessment, the timing analysis and the documentation trail. Whether you need counsel depends on the incident, your contracts and any state notification duties. Your own privacy officer and incident response team should own the filing decision either way.

What drives the cost of outside support, and how should we scope it in writing?

Cost depends on who is paid for what. Legal counsel, a forensic firm, a notification vendor and a technical consultant each bill for different work, and none of them is an auditor. Costs rise with the number of affected individuals, the complexity of the systems involved and how much documentation must be rebuilt after the fact. Ask any provider for a written scope that lists deliverables, who approves each filing, what happens if the breach count changes and what is excluded. DeployOpen does not publish a price list, and a quote follows from a written scope agreed before work starts. Ask counsel how the scope should align with your breach response plan.

Does filing a breach report create a HIPAA penalty?

Filing a report does not by itself create a penalty. Penalties relate to violations of the Privacy, Security or Breach Notification requirements, and OCR decides whether a violation occurred after reviewing the facts. A report can start an OCR investigation, as happened in the OSF HealthCare case, where a 2021 ransomware report led to an investigation that cited an inaccurate risk analysis. The inflation-adjusted civil money penalty for violations, as set out in 45 CFR 102.3, ranges from $145 per violation to $2,190,294 per violation, with a calendar-year cap of $2,190,294 for the most serious tier. Confirm the penalty exposure for your facts with counsel.

Does a business associate's report change the covered entity's duty to report?

No. A business associate may submit a breach report on behalf of a covered entity, but the covered entity's duty to notify individuals and HHS remains its own. Confirm with counsel what your business associate agreement says about who reports, how quickly the business associate must notify you and who keeps the records. Make sure you receive a copy of anything filed on your behalf, and track the transaction number so that any addendum is filed against the correct report.

How DeployOpen prepares breach records and evidence for HHS reporting

DeployOpen works on the systems, logs and records behind a breach report, not the report itself. We help your team assemble the technical evidence that supports each HHS submission, while your privacy and legal leads decide what is reported and who signs it.

How we scope

The written scope lists which systems, logging sources and breach record templates are covered for HHS reporting.
Scope states which decisions stay with your privacy officer, counsel and leadership, and which technical tasks DeployOpen performs.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work begins.

How we build

We configure self-hosted open-source platforms in your environment to keep audit logs and incident records retrievable and time-stamped.
We build a breach record register that tracks each incident separately, with fields for affected counts, estimates and addenda.
We test that log retention and record exports work by running a documented walkthrough against an agreed sample incident.

How we hand over

You receive documentation covering the register, the evidence folder structure and the steps for preparing a portal submission.
Handover includes records of the risk assessment inputs and notifications, so your team can show the burden of proof under the rule.
Ownership of the systems, data and documents transfers to your team, and DeployOpen does not submit reports on your behalf unless agreed in scope.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainer work can refresh the breach register, rerun the record walkthrough and update documentation after platform changes.
Confirm with DeployOpen in your quote which support hours, response expectations and testing cycles are included.

Reporting a HIPAA breach to HHS through the OCR portal