HIPAA Breach Notification Requirements: Timelines, Rules, and What You Must Do

A breach of protected health information (PHI) triggers federal obligations under HIPAA's Breach Notification Rule, with penalties for getting them wrong. Here is what to do if you have a breach, or suspect one.

What Constitutes a Breach Under HIPAA

A breach is any unauthorized acquisition, access, use, or disclosure of PHI that compromises its security or privacy. For example:

• A laptop containing patient records is stolen
• An employee accesses patient files without a legitimate work reason
• PHI is sent to the wrong email address or fax number
• A hacking incident exposes a database containing patient data
• Paper records are improperly disposed of (not shredded)
• A business associate's system is compromised

HIPAA presumes any impermissible use or disclosure is a breach unless you can show a "low probability" of compromise through a four-factor risk assessment.

The Four-Factor Risk Assessment

1. The nature and extent of the PHI. Social Security numbers and diagnoses are higher risk than a name alone.

2. Who received or used it. An employee snooping, an outside hacker, another covered entity, or a random third party.

3. Whether it was actually acquired or viewed, or only exposed.

4. How far the risk was mitigated. Was the data recovered or confirmed destroyed? How long was it exposed?

If more than a low probability of compromise remains, it's a breach and you must notify.

Who You Must Notify

Affected individuals

Notify every affected individual in writing, by first-class mail to their last known address (or email if they agreed to electronic notices). Include:

• A description of the breach (what happened)
• The types of information involved
• Steps individuals should take to protect themselves
• What the organization is doing in response
• Contact information for questions

The Department of Health and Human Services (HHS)

Report every breach to HHS through the Office for Civil Rights (OCR) portal.

• 500 or more individuals: within 60 days of discovery. HHS publishes these in a public, searchable database.
• Fewer than 500: within 60 days of the end of the calendar year of discovery, as an annual log.

Prominent media outlets

If 500 or more residents of one state or jurisdiction are affected, also notify prominent media outlets there.

The Timeline: 60 Days

The clock starts at discovery: when the breach is first known, or would have been known with reasonable diligence.

From the date of discovery:

• Individual notification: Without unreasonable delay, no later than 60 calendar days
• HHS notification (500+): No later than 60 calendar days
• Media notification (500+ in a state): No later than 60 calendar days

If a business associate discovers a breach, they must notify the covered entity within the timeframe specified in the BAA (typically 30 days or fewer), and the covered entity's 60-day clock starts from the date the business associate discovered or should have discovered the breach.

Business Associate Responsibilities

Business associates (form platforms, cloud providers, billing services) must:

• Notify the covered entity of any breach of unsecured PHI
• Identify each affected individual
• Provide what the covered entity needs for its own notices
• Do so within the BAA's timeframe (often 24 to 72 hours; HIPAA's outer limit is 60 days)

Prevention: The Best Breach Response Is No Breach

Encrypt everything. Encrypted PHI (NIST-approved standards such as AES-256 at rest and TLS 1.3 in transit, with keys not compromised) isn't "unsecured PHI," so the notification rule doesn't apply. It's the most effective prevention measure.

Limit access. Role-based access means staff see only what their job needs.

Audit regularly. Review access logs for unusual patterns; earlier detection means a smaller breach.

Train your team. Misdirected emails, stolen devices, and phishing cause many breaches.

Choose vendors carefully. Every business associate is a potential breach source: require a BAA and check their encryption and access controls.

Formisoft uses AES-256 encryption at rest, TLS 1.3 in transit, US-hosted infrastructure, role-based access, and audit logging, and includes a BAA. See how Formisoft handles HIPAA.