HIPAA Breach Notification Rule: 60-Day Requirements Explained

What Is the HIPAA Breach Notification Rule?

The HIPAA Breach Notification Rule is a federal regulation issued by the HHS under the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. It establishes mandatory procedures that covered entities and business associates must follow when a breach of unsecured PHI occurs. The rule applies to all organizations subject to HIPAA, including hospitals, physician practices, health insurance plans, pharmacies, healthcare clearinghouses, and any third-party vendors or subcontractors that handle PHI on their behalf.

The core obligation is straightforward: any impermissible acquisition, access, use, or disclosure of PHI that compromises the security or privacy of that information triggers notification obligations. However, the rule provides a risk assessment framework that allows entities to determine whether an impermissible use or disclosure actually constitutes a breach requiring notification. If the covered entity or business associate demonstrates that there is a low probability that the PHI has been compromised based on a four-factor risk assessment, notification is not required.

The Four-Factor Risk Assessment

To determine whether an impermissible use or disclosure of PHI constitutes a breach, the covered entity or business associate must conduct a risk assessment that considers at least the following four factors as outlined in 45 CFR § 164.402(1):

• The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
• The unauthorized person who used the PHI or to whom the disclosure was made, including whether that person has obligations to protect the information.
• Whether the PHI was actually acquired or viewed, or whether only the opportunity existed for acquisition or viewing.
• The extent to which the risk to the PHI has been mitigated, including through prompt action by the covered entity or business associate.

Importantly, the risk assessment places the burden of proof on the covered entity. If the entity cannot demonstrate a low probability of compromise, the incident is presumed to be a breach, and all notification obligations apply. This presumption reinforces the importance of thorough, documented risk assessments performed promptly after any impermissible use or disclosure.

Who Must Comply With the HIPAA Breach Notification Rule?

The HIPAA Breach Notification Rule applies to two categories of organizations: covered entities and business associates. Covered entities include healthcare providers who conduct electronic transactions, health plans (including employer-sponsored group health plans with 50 or more participants), and healthcare clearinghouses. Business associates are individuals or organizations that create, receive, maintain, or transmit PHI on behalf of a covered entity for functions such as claims processing, data analysis, utilization review, billing, and practice management.

Since the HIPAA Omnibus Rule of 2013, business associates are directly liable for compliance with the Breach Notification Rule. This means that a third-party vendor such as a cloud storage provider, medical transcription service, or IT support firm that experiences a breach of PHI is independently obligated to notify the covered entity of the breach. The covered entity then has the responsibility to notify affected individuals and HHS, unless the business associate agreement specifies otherwise.

What Qualifies as a Breach Under HIPAA?

A breach is defined under 45 CFR § 164.402 as the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI. The definition excludes three specific categories of incidents:

• Unintentional acquisition, access, or use of PHI by a workforce member acting in good faith within the scope of their employment, as long as the information is not further used or disclosed in an impermissible manner.
• Inadvertent disclosure of PHI between persons authorized to access PHI at the same covered entity or business associate, assuming the information is not further used or disclosed.
• Disclosure where the covered entity or business associate has a good faith belief that the unauthorized person to whom the disclosure was made would not have been able to retain the information.

It is critical to note that the "good faith" and "inadvertent" exceptions are narrow and fact-specific. OCR has made clear that these exceptions do not apply to incidents involving malicious intent, gross negligence, or systemic failures. In practice, most security incidents involving external actors — such as hacking, ransomware attacks, or theft of devices containing PHI — will qualify as breaches requiring notification.

The HIPAA Breach Notification Rule: 60-Day Requirements Explained

The 60-day requirement in the HIPAA Breach Notification Rule is one of the most frequently misunderstood provisions. The rule establishes two distinct notification tracks to HHS, and the 60-day timeline applies differently depending on the breach size:

Breaches Affecting 500 or More Individuals

For breaches that affect 500 or more individuals, the covered entity must notify HHS without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach. This notification is submitted electronically through the HHS OCR breach reporting portal. Additionally, if the breach affects 500 or more residents of a state or jurisdiction, the covered entity must also notify prominent media outlets serving that state or jurisdiction — typically the largest-circulation newspaper or broadcast station.

OCR maintains a public "wall of shame" — the HIPAA Breach Notification Rule's list of breaches affecting 500 or more individuals — which is continuously updated and available on the HHS website. Inclusion on this list carries significant reputational risk, which is why many organizations prioritize rapid containment, notification, and remediation.

Breaches Affecting Fewer Than 500 Individuals

For breaches involving fewer than 500 individuals, the covered entity must notify HHS annually. The notification must be submitted no later than 60 days after the end of the calendar year in which the breach was discovered. This means an organization that discovers a small breach in March 2025 must log it internally and report it to OCR by March 1, 2026 — but that reporting obligation does not obviate the need to notify affected individuals within 60 days of discovery.

This annual reporting structure creates a compliance risk if organizations fail to maintain accurate, centralized logs of all breaches throughout the year. A business associate that fails to report a smaller breach to the covered entity in a timely manner may inadvertently cause the covered entity to miss its annual filing deadline.

Notification Timelines: A Complete Breakdown

The HIPAA Breach Notification Rule establishes three distinct notification requirements, each with its own deadline. Understanding these timelines is essential for compliance and avoiding enforcement action.

Notice to Affected Individuals

Covered entities must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of the breach. This notification must be made without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach. The notification must include, at minimum:

• A brief description of the breach, including the date of the breach and the date of its discovery, if known.
• A description of the types of unsecured PHI involved (e.g., name, Social Security number, date of birth, medical record number, diagnosis, treatment information).
• Steps individuals should take to protect themselves from potential harm, such as monitoring credit reports or changing account passwords.
• A brief description of what the covered entity is doing to investigate the breach, mitigate harm, and prevent future breaches.
• Contact information for the covered entity, including a toll-free telephone number, email address, or website where individuals can learn more about the breach.

Notification must be sent by first-class mail to the individual's last known address, or by email if the individual has agreed to receive electronic notices. If the covered entity does not have sufficient contact information for 10 or more individuals, the entity must post a conspicuous notice on its website for at least 90 days or provide substitute notice through print or broadcast media where the affected individuals likely reside.

Notice to HHS

As detailed above, the timeline for notifying HHS depends on the breach size:

For breaches affecting 500 or more individuals: Notification must be made within 60 calendar days of discovery. The covered entity must also notify HHS immediately if the breach involves 500 or more individuals and is discovered after the start of the annual reporting period but before the annual report is due.

For breaches affecting fewer than 500 individuals: Notification is submitted annually, no later than 60 days after the end of the calendar year in which the breach occurred. Entities must log each breach and include all qualifying incidents in a single annual report.

Notice to Media

When a breach affects 500 or more residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving that state or jurisdiction. This notification must also be made without unreasonable delay and within 60 calendar days of the breach discovery. The media notice must contain the same information as the individual notice.

How to Achieve and Maintain HIPAA Breach Notification Compliance

Compliance with the HIPAA Breach Notification Rule requires more than simply knowing the deadlines. Organizations must build operational capabilities that enable rapid breach detection, accurate risk assessment, and flawless execution of the notification process. The following steps provide an enterprise-grade framework for compliance.

Penalties for Non-Compliance

OCR enforces the HIPAA Breach Notification Rule through civil monetary penalties (CMPs) structured in a tiered system based on the entity's level of culpability. The penalty ranges, adjusted annually for inflation, are as follows as of the latest HHS rule:

• Tier 1: Did Not Know — $141 to $34,864 per violation. The entity did not know and, by exercising reasonable diligence, would not have known that the provision was violated.
• Tier 2: Reasonable Cause — $1,393 to $69,729 per violation. The violation was due to reasonable cause and not willful neglect.
• Tier 3: Willful Neglect – Corrected — $13,945 to $69,729 per violation. The violation was due to willful neglect, but the entity corrected the violation within 30 days of discovery.
• Tier 4: Willful Neglect – Not Corrected — $69,729 to $2,134,831 per violation. The violation was due to willful neglect and was not corrected within 30 days.

In addition to CMPs, OCR may require corrective action plans that mandate specific remediation measures, such as revising policies, retraining staff, or implementing new technical safeguards. For breaches that also violate state notification laws — which exist in all 50 states, the District of Columbia, and U.S. territories — entities face additional penalties, including potential private civil actions from affected individuals.

The 2021 American Hospital Association v. Becerra decision clarified that OCR cannot apply penalties retroactively to entities that self-report and promptly mitigate breaches, but only if the entity can demonstrate compliance with all applicable HIPAA rules. This legal environment underscores the importance of proactive breach notification compliance as a liability mitigation strategy.

How HIPAA Breach Notification Works for Business Associates

Business associates have independent obligations under the Breach Notification Rule. When a business associate discovers a breach of PHI that it creates, receives, maintains, or transmits on behalf of a covered entity, the business associate must notify the covered entity without unreasonable delay and within 60 calendar days of discovery. The business associate must include in its notification:

• Identification of the affected covered entity (or entities).
• A description of the breach, including the date of the breach and the date of discovery.
• A description of the types of unsecured PHI involved.
• Steps the covered entity and affected individuals should take to protect themselves.
• The contact information of the business associate's breach response team.

Critically, the business associate does not directly notify affected individuals or HHS — that responsibility falls to the covered entity. However, the business associate is responsible for ensuring its notification to the covered entity contains sufficient information for the covered entity to fulfill its own notification obligations within the 60-day window. Failure to provide timely and complete notification to the covered entity exposes the business associate to direct OCR enforcement.

For business associates operating in multiple jurisdictions, including Canada, the interaction between HIPAA requirements and Canadian privacy laws such as PIPEDA and provincial health privacy laws adds complexity. In cross-border arrangements where PHI is stored or processed in Canada, business associates must navigate both the HIPAA Breach Notification Rule's mandatory 60-day notification and the breach reporting requirements under Canadian law, which may have different timelines and notification thresholds. Canadian cybersecurity compliance services can help organizations manage these dual obligations.

Relationship Between HIPAA Breach Notification and Other Regulations

The HIPAA Breach Notification Rule does not exist in isolation. Organizations that handle PHI are often subject to other regulatory frameworks that impose overlapping or complementary breach notification requirements. For example:

• State breach notification laws: All 50 states, the District of Columbia, and U.S. territories have their own data breach notification laws with varying timelines — typically ranging from 30 to 60 days — and different thresholds for what constitutes protected information. Covered entities must comply with both HIPAA and applicable state law. When state law requires a shorter notification timeline, state law governs.
• Federal Trade Commission (FTC) Health Breach Notification Rule: The FTC enforces a separate breach notification rule under the HITECH Act for vendors of personal health records and related entities that are not covered by HIPAA. This rule applies to health apps, fitness trackers, and other digital health tools.
• SEC Cyber Disclosure Rule: For publicly traded healthcare organizations, the SEC's cybersecurity disclosure rule (effective December 2023) requires timely disclosure of material cybersecurity incidents, including those involving PHI. This creates a parallel disclosure timeline that may run concurrently with HIPAA notification requirements.
• Canadian federal and provincial laws: Under PIPEDA and provincial health privacy laws such as PHIPA in Ontario, organizations that experience a breach of personal health information involving a real risk of significant harm must notify affected individuals, relevant privacy commissioners, and other organizations that may be able to mitigate the harm. The PIPEDA breach notification timeline is "as soon as feasible," which is generally interpreted as requiring notification within days or weeks, not the full 60 days permitted under HIPAA.

For organizations operating across the U.S.-Canada border, building a unified breach response capability that addresses the most stringent requirements from all applicable jurisdictions is the most efficient and defensible approach. U.S. cybersecurity compliance services can help map these overlapping requirements and build a single, integrated notification workflow.

Best Practices for Proofing Your HIPAA Breach Response

A robust HIPAA breach response program goes beyond minimum compliance to build organizational resilience and trust. Consider these best practices drawn from OCR settlement agreements and industry guidance:

1. Reduce detection time through automation. The 60-day clock starts ticking from the moment the breach is discovered — not from the moment it occurred. Organizations that detect breaches faster have more time to perform risk assessments and prepare notifications. Implementing a SIEM solution such as ThreatHawk SIEM with real-time monitoring of PHI access logs can compress detection time from days to minutes.

2. Pre-draft notification templates and workflows. Developing FDA/OCR-approved notification templates in advance — for individual notices, media notices, and HHS submissions — eliminates the time-consuming drafting process during a breach event. Pre-approve these templates with legal counsel to ensure they meet all content requirements under 45 CFR § 164.404(c).

3. Conduct annual tabletop exercises. Mock breach scenarios that test the 60-day notification workflow under simulated pressure conditions reveal gaps in communication, delays in risk assessment completion, and technical issues with notification systems. OCR has cited failure to test incident response plans as a contributing factor in several enforcement actions.

4. Maintain a secure, centralized breach log. Use a compliance management platform — not spreadsheets — to track every incident from detection through closure. The log should include timestamps for each step in the notification process to demonstrate compliance with the "without unreasonable delay" standard, even if the notification occurs well within the 60-day maximum.

5. Train workforce members continuously. Every workforce member who handles PHI should be trained to recognize potential breaches and escalate them to the breach response team immediately. Training should cover the distinction between impermissible uses and disclosures that require a risk assessment versus those that qualify for the "inadvertent" exception, which is narrower than most employees assume.

Frequently Asked Questions