HIPAA Breach Notification Rule: A Plain-English Guide
What covered entities and business associates must actually do when protected health information is breached. Current deadlines, who gets told, and a pending rule change worth watching.
The current rule, in one paragraph
When unsecured protected health information, or PHI, is breached, HIPAA's Breach Notification Rule (45 CFR §§ 164.400 to 414) makes you tell the people affected without unreasonable delay and no later than 60 days after you find out. The same 60-day clock applies to telling the Department of Health and Human Services, or HHS, for breaches affecting 500 or more people. Smaller breaches get logged inside your own shop and reported to HHS once a year. Breaches affecting 500 or more residents of one state also require telling big media outlets in that area.
That 60-day standard is current, settled law as of this writing. It is not a proposal. It is worth saying plainly because there is real confusion right now, noted below, about whether it has already changed.
The full notice table
| Who gets told | What starts it | Deadline |
|---|---|---|
| The people affected | Any breach of unsecured PHI | Without unreasonable delay, no later than 60 days from finding out |
| HHS Office for Civil Rights | Breach affects 500+ people | Same 60-day deadline, told one by one per event |
| HHS Office for Civil Rights | Breach affects fewer than 500 people | Logged inside, reported yearly, within 60 days of the year's end |
| Media | Breach affects 500+ residents of one state | Same 60-day deadline |
| Covered entity, told by a business associate | Business associate finds a breach | Without unreasonable delay, no later than 60 days |
What counts as a breach? The four-factor test
Not every wrong use or leak of PHI is a reportable breach. HIPAA presumes it is one unless the group can show, through a written risk check, a low chance that the PHI was truly put at risk. The check rests on at least four factors:
- The nature and extent of the PHI involved. What kinds of identifiers? How easy is it to re-identify someone?
- The unauthorized person who used the PHI or got the leak.
- Whether the PHI was truly taken or truly seen.
- How well the risk to the PHI was already fixed.
Write the risk check down at the time. Do not rebuild it later if OCR comes asking.
A pending change worth watching, carefully
HHS's Office for Civil Rights put out a Notice of Proposed Rulemaking in December 2024. It would be the first big HIPAA Security Rule overhaul since 2013. News coverage of this proposal has been shaky on specifics. Some stories describe a shorter reporting window. Both 72-hour and 24-hour numbers have shown up in different proposals. There is real dispute in current reporting about how far along the process is. Some sources say it is still pending, with a federal timeline stretching well into 2027. At least one source claims a shorter window is already in effect. Given that dispute, do not treat any shorter timeline as current law without checking with your own counsel or HHS's own published rule status. This is exactly the kind of detail to verify before it goes into your IR plan. Do not assume from one source.
What is safe to act on now: build your IR plan and vendor ties, meaning IR retainer, forensics, and legal counsel, expecting reporting windows to tighten. The direction of travel is clearly toward faster rules, even where the final number is not yet set.
What this means for your IR plan
- The 60-day clock starts at discovery, not confirmation. "Discovery" is read broadly. You cannot stall the clock by investigating slowly. Build your plan's timeline back from 60 days, not forward from when the probe wraps up.
- Write the risk check down in real time. If you decide a breach does not need reporting under the four-factor test, record that call as it happens. Rebuilding it later during an OCR inquiry puts you in a much weaker spot.
- Your business associate contracts should promise notice to you faster than 60 days. Your own 60-day clock starts when the business associate finds the breach, not when they get around to telling you.
- Check your retainer firm for real HIPAA breach work. The risk-check paperwork and notice coordination above have a real HIPAA-specific process. General IR skill alone is not the same thing.
Does your group handle PHI? Then this rule should already sit inside your IR plan's notice section. Do not work it out for the first time during a real breach.
Browse verified incident response providers with healthcare sector experience →This guide reflects current HIPAA Breach Notification Rule requirements as of publication. The pending Security Rule proposal noted above is still working through the federal rulemaking process. Check current status before relying on any shortened timeline. Last verified: October 2026. Have a correction or addition? Request inclusion or a correction →
Continue reading
Best Incident Response Companies 2026: Ranked by What's Documented, Not What's Claimed
Search for the best incident response companies and you get two things. Vendor blogs that rank themselves first. And listicles that rank by adjectives. Neither survives contact with a real incident. What survives is evidence: which firms carriers' claims teams keep re-hiring, what the firms document about their own capability, and how their claims check out. This page ranks the market's most-documented IR firms. It tells you exactly what the ranking can and cannot say.
Best Operational Technology (OT) Incident Response Firms 2026: Ranked by What's Documented, Not Claimed
Search for OT security companies and you get two bad options. Vendor listicles rank whoever pays them. Vendor blogs rank themselves. The OT market deserves better, because a wrong pick costs production hours. This page lists the OT incident response firms we could verify from their own published services. It puts them in the order the evidence supports. Where the evidence is thin, it says so.