Oct 19, 2026

HIPAA Breach Notification Rule: Key Compliance Steps

A data breach may take weeks or months to discover. The response deadline doesn't wait that long. Once a qualifying breach is discovered, the 60-day notification clock begins. U.S. healthcare organizations reported a record 772 large breaches in 2025, according to HIPAA Journal's analysis of OCR data. Together, those incidents exposed roughly 138.5 million patient records. What happens next depends on how quickly the organization can determine who needs to be notified, what they need to know, and what must be documented.

The HIPAA Breach Notification Rule governs every part of that process for covered entities and business associates handling protected health information. Here's what you need to know to move through it correctly.

What is the HIPAA Breach Notification Rule?

The HIPAA Breach Notification Rule requires you to notify affected individuals after unsecured protected health information is breached. It sits at 45 CFR §§ 164.400-414. Both covered entities and their business associates must follow the rule. A breach occurs when PHI is used or disclosed without permission in a way that compromises its privacy or security. HIPAA presumes an incident is a breach the moment it happens. You must prove otherwise through a documented risk assessment. Without that proof, notification becomes mandatory.

A Breach Is Presumed Unless a Four-Factor Risk Assessment Shows Low Probability

Every impermissible use or disclosure of PHI counts as a breach by default. You can clear that presumption by running a risk assessment across four factors.

A Breach Is Presumed Unless a Four-Factor Risk Assessment Shows Low Probability

The table below breaks down what each factor actually evaluates.

Factor	What You're Assessing
Nature and extent of PHI	The types of identifiers involved and how easily someone could be re-identified from them
Recipient	Who accessed or received the PHI, and whether they were authorized to see it
Acquisition or viewing	Whether the PHI was actually acquired or viewed, not just technically exposed
Mitigation	How much you've reduced the risk since discovering the incident

A low-probability finding across all four factors is the only way to avoid notification. Falling short on even one factor means you must notify.

Three Situations Are Excluded From the Breach Definition

Not every improper PHI exposure counts as a breach. HIPAA carves out three exceptions.

1. Unintentional workforce access

A receptionist who opens the wrong file by mistake falls under this exception, as long as she doesn't disclose what she saw any further.

2. Inadvertent disclosure between authorized people

A nurse forwarding lab results to the wrong doctor in your practice fits here, provided that doctor doesn't misuse the data.

3. Inability to retain the information

You have good reason to believe the unauthorized recipient couldn't retain it, such as mail returned unopened by the postal service.

All three still require you to document why the incident doesn't qualify as a breach.

Notification Deadlines Depend on Whether a Breach Affects 500 or More People

The size of a breach determines who you must notify and how fast. Every breach requires you to notify affected individuals directly. You do this by first-class mail, or by email if the individual has agreed to it. The 60-day clock starts on the date you discover the breach.

Notification Deadlines Depend on Whether a Breach Affects 500 or More People

The table here shows how crossing the 500-person threshold changes your remaining obligations.

Recipient	Trigger	Deadline
Affected individuals	Every breach	Within 60 days of discovery
Media outlets	Breach affects 500+ people in one state or jurisdiction	Within 60 days of discovery
HHS Secretary	Breach affects 500+ people	Within 60 days of discovery
HHS Secretary	Breach affects fewer than 500 people	Annually, within 60 days of the calendar year's end

You owe substitute notice too if you can't reach 10 or more individuals through the contact information you have on file. That means posting the breach on your website's homepage for 90 days, or publishing it through major print or broadcast media serving the area.

Business Associates Must Notify Covered Entities Within 60 Days

A breach at your business associate doesn't exempt you from the notification chain. Your business associate must notify you as soon as they discover the breach. They have no more than 60 days to do it. Their notification must include, where possible, a list of every individual affected. You and your business associate can agree on who actually sends the individual notices. That decision usually comes down to who has the direct relationship with the affected people.

Covered Entities Bear the Burden of Proving Compliance

You carry the burden of proof after any impermissible use or disclosure of PHI. You must show that you sent every required notification. If you decided not to notify, you must show why. That means keeping your risk assessment on file, or documenting which exception applied. HIPAA also requires you to maintain written policies and procedures for breach notification. You must train your workforce on those policies. You must apply sanctions against anyone who doesn't follow them.

HIPAA Breach Notification Rule Penalties Can Reach $1.5 Million Per Violation Category Per Year

Missing the 60-day notification deadline is itself a violation, separate from the breach. Delaying notification without good reason also counts as a violation, even if you notify before the deadline technically expires. The maximum penalty is $1.5 million per violation category, per calendar year.

A healthcare provider once discovered a breach in October but didn't notify HHS until the following January, more than a month past the deadline. That provider settled the resulting case for $475,000. State attorneys general can pursue these cases too, alongside HHS.

Key Compliance Steps for Meeting Breach Notification Requirements

Build a documented risk assessment protocol before you need one. Waiting until a breach happens to figure out your process costs you time you don't have within the 60-day window. Work through these steps to stay ready:

Encrypt PHI properly. If stolen PHI is encrypted using an HHS-approved method and the key is not compromised, notification is generally not required.
Destroy PHI before throwing it away. Shred paper records and securely destroy electronic records instead of discarding them intact.
Have a clear breach response plan. Define who investigates the breach, who handles notifications, and who documents the response.
Set earlier deadlines with business associates. Your agreements can require vendors to report breaches before the 60-day maximum.
Train employees to spot breaches. Staff should know what a potential breach looks like and who to report it to.
Keep breach records for at least six years. Store risk assessments, notification letters, and exception justifications for the required period.

Effivity's ISMS Automates the Compliance Steps This Rule Requires

You don't have to manage risk assessments, incident logs, and breach documentation across separate spreadsheets. Effivity's Information Security Management Software supports HIPAA alongside ISO 27001, SOC 2, and other frameworks natively.

Its Risk Management module runs your four-factor risk assessment and generates a risk register automatically, so you always have the documentation OCR expects during an investigation. Its Incident Management module logs every breach with severity, timeline, and root cause, and tracks each notification through to closure.

You get a centralized repository for every policy, risk assessment, and notification record, all timestamped and audit-ready. When OCR asks you to prove you met your 60-day deadline, the evidence is already there instead of scattered across email threads.

Visit Effivity’s website now to learn more!

Frequently Asked Questions

What counts as protected health information under this rule?

Protected health information covers any individually identifiable health data you create, receive, or maintain. Names, Social Security numbers, diagnoses, and treatment records all qualify. The rule only applies when this information is unsecured, meaning it isn't encrypted or destroyed according to HHS guidance.

Is a risk assessment mandatory before you notify affected individuals?

No, the risk assessment is optional. You can skip it entirely and proceed straight to notification. Skipping it just means you lose the chance to prove the incident doesn't qualify as a reportable breach.

Does this rule apply to business associates directly?

Yes, business associates carry their own notification duty under the rule. They must notify you within 60 days of discovering a breach. You remain ultimately responsible for notifying affected individuals, even when a business associate caused the breach.

SivaSankarVikranth B

QA Manager at Effivity

SivaSankarVikranth has extensive 7 years of experience in IT, helping clients achieve top-quality software solutions. His dedication to quality and strong technical skills drive Effivity’s success and customer satisfaction.

View All Posts

Improve Workflow & Profitability with Superior Integrated Management System Software free-demo

Schedule a Free Demo