HIPAA Breach Notification: What Healthcare Organizations Must Do After a Breach

For any covered entity or business associate subject to HIPAA, discovering a potential breach of protected health information is one of the most stressful events an organization can face. The combination of legal complexity, reputational risk, and tight regulatory deadlines creates an environment where well-prepared organizations navigate the situation effectively and unprepared ones make it significantly worse. The HIPAA Breach Notification Rule, codified in 45 CFR Part 164 Subpart D, establishes a clear framework for what must happen after a breach is discovered. Understanding that framework in advance of any incident is essential.

What Is a Breach Under HIPAA?

HIPAA defines a breach as the acquisition, access, use, or disclosure of protected health information in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI. The definition is broad and deliberately so. It covers incidents ranging from a ransomware attack that encrypts electronic health records to an employee accidentally sending a patient’s records to the wrong recipient to a vendor misconfiguring a database so that patient information is exposed on the public internet.

There is a statutory presumption that any impermissible use or disclosure of PHI is a breach. This presumption can be overcome — but the burden is on the covered entity or business associate to demonstrate that the PHI was not compromised. HIPAA provides three specific exceptions to the definition of breach. First, an unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of authority, if the PHI is not further used or disclosed impermissibly. Second, an inadvertent disclosure of PHI from one authorized person to another authorized person within the same covered entity or organized health care arrangement. Third, where the covered entity or business associate has a good faith belief that the unauthorized recipient would not have been able to retain the information — for example, where a misdirected fax is immediately returned without being read.

The Four-Factor Risk Assessment

For any impermissible use or disclosure that does not fall within one of the three statutory exceptions, the covered entity or business associate must conduct a risk assessment to determine whether the incident constitutes a breach. The risk assessment evaluates four factors. First, the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification. Second, who accessed the PHI and whether the unauthorized party had a legal obligation to protect the privacy of the information, such as a healthcare professional. Third, whether the PHI was actually acquired or viewed, or whether only the opportunity to access existed without any evidence of actual access. Fourth, the extent to which the risk to the PHI has been mitigated, including whether any encryption or other security measures were in place.

If the risk assessment demonstrates a low probability that the PHI has been compromised based on all four factors, the incident is not a breach and notification is not required. But the analysis must be documented, and the documentation must be retained for six years. If a regulatory investigation later determines that the risk assessment was inadequate or that its conclusions were not supported by the facts, the covered entity can face enforcement action for both the underlying incident and the failure to notify.

Notification to Individuals

If a breach has occurred, the covered entity must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovery of the breach. The notification must be written in plain language and must include a description of what happened, including the date of the breach and the date of discovery if known. It must describe the types of unsecured PHI involved — such as full name, Social Security number, date of birth, home address, account number, diagnosis, or treatment information. It must include the steps the individual should take to protect themselves from potential harm. It must describe what the covered entity is doing to investigate the breach, mitigate the harm, and prevent future occurrences. And it must explain how affected individuals can contact the covered entity for more information, including a toll-free phone number, email address, website, or postal address.

The notification must be provided by first-class mail to the individual’s last known address, or electronically if the individual has agreed to receive electronic notice. If the covered entity has insufficient contact information for 10 or more individuals, it must provide substitute notice through a prominent posting on the homepage of its website for at least 90 days or through major print or broadcast media in the geographic area where the affected individuals likely reside.

Notification to the Department of Health and Human Services

Covered entities must also notify the Department of Health and Human Services of every breach involving PHI, but the timing and mechanics depend on the size of the breach. For breaches affecting 500 or more individuals, notification to HHS must be provided simultaneously with individual notification — that is, without unreasonable delay and within 60 days of discovery. These large breaches are also publicly posted by HHS on what is commonly referred to as the HIPAA Wall of Shame, a searchable database of breaches affecting 500 or more individuals that is accessible to anyone and is closely monitored by regulators, plaintiffs’ attorneys, journalists, and anyone with a business interest in healthcare cybersecurity.

For breaches affecting fewer than 500 individuals, notification to HHS may be delayed until 60 days after the end of the calendar year in which the breach was discovered. Covered entities must maintain a log of small breaches and submit that log to HHS annually. Despite the delayed deadline for small breaches, covered entities must still notify affected individuals within 60 days of discovery of the breach.

Media Notification for Large Breaches

When a breach affects more than 500 individuals in a single state or jurisdiction, the covered entity must also provide notice to prominent media outlets serving that state or jurisdiction. The media notification must be provided within the same 60-day window as individual notification. The purpose of this requirement is to ensure that residents of the affected area have access to information about the breach even if the covered entity’s direct notification efforts do not reach every affected individual.

Business Associate Notification Obligations

Business associates that discover a breach of PHI have their own notification obligation: they must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The business associate’s notification to the covered entity must include, to the extent possible, the identification of each individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed during the breach. The covered entity then has its own notification obligations to individuals, HHS, and the media.

A business associate agreement should address what information the business associate must provide in its breach notification to the covered entity and the timeline for doing so. Many BAAs require notification in less than 60 days — sometimes within 24 to 72 hours of discovery — to give the covered entity sufficient time to assess the incident and meet its own notification deadlines.

When Does the Clock Start?

The 60-day notification deadline runs from the date the breach is discovered, not the date it occurred. A breach is treated as discovered as of the first day on which the covered entity or business associate knows or, by exercising reasonable diligence, would have known of the breach. This standard means that an organization cannot avoid the notification deadline by deliberately avoiding knowledge of a potential breach. If a covered entity has sufficient information to reasonably suspect that a breach may have occurred and does not investigate, it may be treated as having constructive knowledge of the breach from the date that reasonable investigation would have revealed it.

Because the discovery date triggers the deadline, organizations that experience a potential breach should investigate promptly. Engaging qualified forensic professionals to assess the scope of the incident, determine what data was involved, and document the investigation is an important step in managing the breach response timeline and in building the record that supports the risk assessment and any subsequent regulatory inquiry.

Preparing Before a Breach Occurs

The most effective breach notification programs are built before any breach occurs. A written incident response plan that identifies roles and responsibilities, establishes clear escalation procedures, designates legal counsel and forensic resources in advance, and specifies the documentation requirements for the risk assessment and notification process enables organizations to respond quickly and effectively when an incident occurs. Organizations that are scrambling to understand their obligations while simultaneously managing a live security incident are far more likely to make procedural errors that complicate their regulatory exposure.