HIPAA Breach Notification Requirements

What Is Considered a HIPAA Breach

Under 45 CFR §164.402, a breach is the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the information. “Unsecured” means the PHI was not encrypted or destroyed in accordance with HHS guidance.

Three Statutory Exceptions

Even when unsecured PHI is improperly accessed, the following scenarios are excluded from the breach definition:

Step-by-Step Response Process

When a potential breach is identified, follow this decision path. At each stage, document your analysis — OCR evaluates your process, not just the outcome.

The Four-Factor Risk Assessment

Before notifying, you must determine whether a reportable breach actually occurred. The Breach Notification Rule at §164.402(2) requires a documented assessment of four factors. If the assessment demonstrates a low probability the PHI was compromised, notification is not required. Document the analysis either way — OCR will ask for it.

Notification Timelines

The phrase “without unreasonable delay” appears throughout the Breach Notification Rule, but the hard ceiling is 60 calendar days from discovery. Discovery occurs on the first day the breach is known or, by exercising reasonable diligence, would have been known. Willful ignorance does not extend the clock.

Business Associate Obligations

When a breach originates at a business associate, the BA must notify the covered entity within 60 days of discovery (§164.410). The covered entity then has its own 60-day window to notify individuals. Many BAAs contractually shorten this to 30 days or less to preserve response time.

Notification Letter Requirements

The notification letter must be written in plain language and delivered via first-class mail. Email is acceptable only if the individual previously agreed to electronic communication. The letter must include all five elements specified in §164.404(c):

Substitute Notice

When contact information is insufficient or outdated, substitute notice is required:

Breach Notification Letter Template

Replace every bracketed placeholder with your organization's details. Have legal counsel review before sending — this template covers the five required elements but your state may impose additional content requirements.

[Organization Name]
[Address]
[City, State ZIP]
[Date]

[Recipient Name]
[Address]
[City, State ZIP]

RE: Notice of Breach of Unsecured Protected Health Information

Dear [Recipient Name],

We are writing to inform you of an incident involving your protected health information (PHI) as required by the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR §164.404.

WHAT HAPPENED
On [date of discovery], we discovered that [brief, factual description of the breach]. The incident occurred on or about [date of breach].

INFORMATION INVOLVED
The types of information that may have been affected include: [list specific types — e.g., your name, date of birth, Social Security number, medical record number, diagnosis information, health insurance information].

WHAT WE ARE DOING
Upon learning of this incident, we immediately [describe mitigation steps — e.g., secured the affected system, engaged a forensic security firm, reported the incident to law enforcement, enhanced our security measures, re-trained workforce members]. We have also reported this incident to the U.S. Department of Health and Human Services as required by federal law.

WHAT YOU CAN DO
We recommend the following steps to protect yourself:
- Monitor your explanation of benefits (EOB) statements for any unfamiliar charges
- Review your credit reports from Equifax, Experian, and TransUnion
- Consider placing a fraud alert or credit freeze on your credit files
- [If SSN was involved: We are offering [X] months of complimentary credit monitoring through [provider name]. To enroll, visit [URL] or call [phone number] by [enrollment deadline]]

CONTACT INFORMATION
If you have questions or need additional information, please contact:
[Contact name or department]
Phone: [toll-free number]
Email: [email address]
[Mailing address]

This contact line will remain active for at least 90 days.

We deeply regret this incident and are committed to protecting your information. We have taken steps to prevent a similar event from occurring in the future.

Sincerely,

[Privacy Officer Name]
[Title]
[Organization Name]

The 500-Individual Threshold

Breaches affecting 500 or more individuals trigger two additional obligations beyond individual notice. Both carry the same 60-day deadline from discovery.

Breaches Affecting Fewer Than 500

Smaller breaches do not require immediate HHS reporting or media notice, but you must still:

• Notify each affected individual within 60 days
• Maintain an internal log of every breach incident
• Submit an annual summary to HHS within 60 days of calendar year-end

Accidental HIPAA Breach: What to Do

Most breaches are not malicious attacks — they are accidental disclosures. A staff member emails PHI to the wrong recipient. A paper record is left in a public area. A laptop without encryption is lost. Regardless of intent, the response process is the same.

For a structured approach to incident handling, build a formal audit checklist that includes breach response procedures. Organizations with a documented incident response plan resolve breaches 37% faster on average, according to the Ponemon Institute.

Penalties for Late or Missing Notification

Failure to notify — or unreasonable delay in notifying — is itself a HIPAA violation. OCR applies the same four-tier civil monetary penalty structure:

Penalty amounts adjusted for inflation per HHS annual updates (2026 figures). State attorneys general can pursue additional penalties.

Real-World Enforcement