HIPAA Breach Notification Requirements: Deadlines, Notices and a Readiness Checklist
HIPAA breach notification requirements say that after discovering a breach of unsecured protected health information (PHI), a covered entity must notify each affected individual without unreasonable delay and no later than 60 days after discovery. Depending on the breach's size, it must also notify the Department of Health and Human Services (HHS) and, for breaches affecting more than 500 residents of a state or jurisdiction, prominent media outlets there.
The deadlines are the easy part. The hard part is deciding, quickly and defensibly, whether an incident is a breach at all, and proving afterward that you did everything required. In my experience, teams that struggle here don't lack good intentions; they lack the inventory, the decision owner and the records. This guide covers the rules and how to be ready before you need them.
What counts as a breach under HIPAA?
Under HIPAA, a breach is generally an impermissible use or disclosure of PHI under the Privacy Rule that compromises its security or privacy. The rule starts from a presumption: an impermissible use or disclosure is presumed to be a breach unless you can demonstrate a low probability that the PHI has been compromised.
HHS lists three exceptions where an incident is not a breach:
- Unintentional workforce access: a workforce member or someone acting under your authority unintentionally acquires, accesses or uses PHI in good faith and within the scope of their authority.
- Inadvertent internal disclosure: a person authorized to access PHI inadvertently discloses it to another authorized person at the same entity (or organized health care arrangement), and it isn't further used or disclosed impermissibly.
- Information couldn't be retained: you have a good-faith belief that the unauthorized recipient would not have been able to retain the information.
Why "unsecured" PHI matters
Notification duties apply only to breaches of unsecured PHI: PHI not rendered unusable, unreadable or indecipherable to unauthorized people using a method HHS's guidance specifies. That guidance names encryption and destruction. If a lost laptop's data was encrypted to HHS's standard, notification isn't required. That's why knowing which systems and devices are encrypted is one of the most valuable facts in your PHI inventory.
How do you decide whether an incident is a breach?
You decide with a documented risk assessment of at least four factors, unless you choose to skip the assessment and notify. HHS lists them as:
- The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
- The unauthorized person who used the PHI or to whom it was disclosed.
- Whether the PHI was actually acquired or viewed.
- The extent to which the risk to the PHI has been mitigated.
Write the assessment down every time, including when you conclude no notification is needed. Covered entities and business associates carry the burden of demonstrating that required notifications were made, or that an exception or a low-probability finding applied.
What are the HIPAA breach notification deadlines?
The core HIPAA breach notification deadline is 60 days from discovery, but who you notify depends on how many people are affected.
| Notice to | When it's required | Deadline |
|---|---|---|
| Affected individuals | Every breach of unsecured PHI | Without unreasonable delay, no later than 60 days after discovery |
| Prominent media outlets | More than 500 residents of a state or jurisdiction affected | Without unreasonable delay, no later than 60 days after discovery |
| HHS (the Secretary) | 500 or more individuals affected | Without unreasonable delay, no later than 60 days after the breach |
| HHS (the Secretary) | Fewer than 500 individuals affected | May be reported annually, no later than 60 days after the end of the calendar year in which the breach was discovered |
| Covered entity (from a business associate) | A breach at or by a business associate | Without unreasonable delay, no later than 60 days after discovery |
Sixty days is a maximum, not a target. "Without unreasonable delay" means you shouldn't wait until day 59 if you could have notified sooner. State breach laws may add their own requirements, so check those with counsel too.
What must a breach notice to individuals include?
A breach notice to individuals must be written in plain language and include five things:
- A brief description of the breach.
- The types of information involved.
- Steps individuals should take to protect themselves from potential harm.
- A brief description of what you're doing to investigate, mitigate harm and prevent further breaches.
- Contact information for your organization.
How notices must be sent
Send written notice by first-class mail, or by email if the individual agreed to electronic notice. If contact information is out of date for fewer than 10 people, you may use an alternative written notice, telephone or other means. For 10 or more, substitute notice must be either a conspicuous posting on your website's home page for at least 90 days or notice in major print or broadcast media where they likely live, plus a toll-free number that stays active for at least 90 days.
That last rule is a quiet argument for data quality: outdated patient addresses don't just bounce statements, they turn a mailed notice into a website posting and a 90-day phone line.
What do business associates have to do?
A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery, identifying each affected individual to the extent possible. The covered entity remains responsible for notifying individuals, though it can delegate that work to the business associate.
Many business associate agreements set a shorter window than 60 days. Know what each of yours says before you need it. If you're a health tech vendor, the same applies in reverse: your hospital customers will hold you to the timeline in your BAA.
How do you get breach-notification ready before an incident?
You get ready by deciding the steps, owners and records now, while nothing is on fire. HHS requires covered entities to have written breach notification policies and procedures, train the workforce on them and apply sanctions when they're not followed. Use this checklist:
- Name the decision owner: one person, usually the privacy officer, who decides whether an incident is a breach, with a backup.
- Keep a current PHI inventory: list every system, vendor and device with PHI, and whether its data is encrypted. This answers "what was exposed?" in hours instead of weeks.
- Map where PHI flows: reports and extracts that copy PHI into email or shared drives are common sources of incidents.
- Log every incident: date found, what happened, records involved, four-factor result, decision, notices sent and dates.
- Prepare notice templates: a draft individual notice with the five required elements, plus an HHS reporting checklist.
- Track BAA notice windows: record each vendor's agreed timeline next to the vendor in your inventory.
- Train and test: walk through one tabletop scenario a year, such as a lost laptop or a misdirected email.
Most of these items also feed your risk analysis. Our guide to building a HIPAA risk register shows how to score and track the risks you find along the way.
Why does preparation make such a difference?
Preparation matters because healthcare breaches are slow to find and expensive to resolve. IBM's 2025 Cost of a Data Breach report put the average U.S. healthcare breach at $7.42 million, the costliest of any industry it studied for 14 years running, and found healthcare breaches took 279 days to identify and contain, the longest of any industry (HIPAA Journal summary of IBM's report).
You can't control whether an incident happens. You can control whether, on day one, you know what PHI was involved, who decides and where the evidence goes. If that information lives in spreadsheets and inboxes today, see how it compares with a dedicated system in Tracewell vs. spreadsheets. For help writing the policies and running a tabletop, our Readiness Assessment covers breach readiness as part of a PHI risk review.
Frequently asked questions
Do you have to report a HIPAA breach that affects fewer than 500 people?
Yes. You must notify each affected individual within 60 days of discovery, and report the breach to HHS. For breaches affecting fewer than 500 people, HHS reports may be submitted annually, no later than 60 days after the end of the calendar year in which the breach was discovered.
Is a lost encrypted laptop a HIPAA breach?
If the PHI on it was encrypted to the standard in HHS guidance, it isn't unsecured PHI, and breach notification isn't required. Document the device, its encryption and your conclusion so you can show why no notice was sent.
When does the 60-day breach notification clock start?
The clock runs from discovery of the breach, not from the end of your investigation. Sixty days is the outer limit: HIPAA requires notice without unreasonable delay, so notify sooner if you can.
Who notifies patients when a vendor has a breach?
The covered entity remains responsible for notifying affected individuals. The business associate must notify the covered entity within 60 days of discovery, or sooner if your business associate agreement says so, and the covered entity can delegate sending the notices to the business associate.
Sources
- HHS: Breach Notification Rule
- The HIPAA Journal: Average cost of a healthcare data breach (IBM 2025)
This article is general information, not legal advice. Work with your privacy officer and legal counsel on your organization's specific obligations, including state breach laws.