HIPAA breach notification: what HHS requires after a breach of patient information
HHS’s Breach Notification Rule requires HIPAA covered entities and their business associates to give notice after a breach of unsecured protected health information. HHS says an impermissible use or disclosure is presumed to be a breach unless a risk assessment shows a low probability that the information was compromised. Covered entities notify affected individuals, the Secretary of HHS, and, for larger breaches, the media. Business associates notify the covered entity. Who is a covered entity, and what the Privacy and Security Rules say, are on HIPAA for therapists. No penalty or settlement amounts are copied.
Quoted from official pages checked November 10, 2026. Confirm current requirements, fees, and dates on those sites. This page is not legal advice and does not guarantee eligibility, certification, or licensure.
Sources read on November 10, 2026: HHS’s Breach Notification Rule page (content last reviewed July 26, 2013), HHS’s Submitting Notice of a Breach to the Secretary page (content last reviewed February 13, 2026), and 45 CFR Part 164, Subpart D on eCFR (up to date as of 11/06/2026).
What counts as a breach
The regulation, 45 CFR 164.402, states: “Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.”
HHS’s page states: “An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:” The four factors are the nature and extent of the information, the unauthorized person who used it or received it, “Whether the protected health information was actually acquired or viewed; and”, and the extent to which the risk has been mitigated.
HHS states: “There are three exceptions to the definition of ‘breach.’” In short, they cover unintentional good-faith access by a workforce member acting within the scope of authority; inadvertent disclosure between people authorized to access the information at the same covered entity, business associate, or organized health care arrangement; and a good faith belief that the person who received the information could not have kept it.
Unsecured information
HHS states: “Covered entities and business associates must only provide the required notifications if the breach involved unsecured protected health information.” It says HHS guidance “specifies encryption and destruction as the technologies and methodologies for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals.”
When a breach is discovered
45 CFR 164.404(a)(2) states that a breach “shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity.”
Notice to individuals
HHS states: “Covered entities must provide this individual notice in written form by first-class mail, or alternatively, by e-mail if the affected individual has agreed to receive such notices electronically.” On timing: “These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach”. The notice must include, to the extent possible, a description of the breach and the types of information involved, the steps individuals should take, what the covered entity is doing, and contact information. HHS also describes substitute notice when contact information is out of date.
Notice to the media and to HHS
HHS states: “Covered entities that experience a breach affecting more than 500 residents of a State or jurisdiction are, in addition to notifying the affected individuals, required to provide notice to prominent media outlets serving the State or jurisdiction.”
For notice to the Secretary, HHS’s rule page states: “If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach.” HHS’s reporting page says: “No later than 60 calendar days from the discovery of the breach”. The two pages’ wording is left side by side. The media rule says more than 500 residents of a State or jurisdiction; the Secretary rule says 500 or more individuals.
For smaller breaches, the rule page states: “Reports of breaches affecting fewer than 500 individuals are due to the Secretary no later than 60 days after the end of the calendar year in which the breaches are discovered.” The reporting page adds: “You do not have to wait until the end of the year (you may report the breach as soon as it is discovered)”. HHS takes these reports through its online breach reporting portal.
Business associates
HHS states: “A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach.” It adds that the covered entity “may delegate the responsibility of providing individual notices to the business associate.”
Proof and policies
HHS states: “Covered entities and business associates, as applicable, have the burden of demonstrating that all required notifications have been provided or that a use or disclosure of unsecured protected health information did not constitute a breach.” It adds that covered entities “must have in place written policies and procedures regarding breach notification, must train employees on these policies and procedures, and must develop and apply appropriate sanctions against workforce members who do not comply with these policies and procedures.”
What this page does not do
It does not copy penalty or settlement amounts, does not say whether any incident is a breach, and does not describe state breach laws. It is not legal, billing, or compliance advice. Confirm current rules with the agency or organization that publishes them, your employer, and your state board.