HIPAA breach notification: from the discovery date to the HHS report

The clock starts on the first day anyone on your workforce, or an agent such as a billing vendor under your control, knows of a breach or would have known with reasonable diligence (45 CFR 164.404(a)(2)). It does not wait for forensics, counsel or a final record count. The four steps below are for security leads and privacy officers at covered entities and business associates; they include a signal table for the discovery date, a filled assessment record, a dated calendar and a letter you can complete in your browser.

Our assessment: teams lose time at two points, not at the deadlines. One is the discovery date, which is usually earlier than they assume. The other is the no-notice decision, which is presumed wrong until the entity documents otherwise.

Step 1: Is the data unsecured PHI?

Notice duties attach only to unsecured PHI: protected health information not rendered unusable, unreadable or indecipherable to unauthorized persons by a method in HHS guidance (45 CFR 164.402). If the data was properly encrypted or destroyed, there is no reportable breach. Check three things before relying on that.

• The key. HHS's guidance requires that the "confidential process or key that might enable decryption has not been breached," and says decryption tools should be stored apart from the data they unlock. Our application: a key kept on the same server, or in the same compromised account, voids the safe harbor.
• Powered-on systems. HHS's ransomware fact sheet says full disk encryption protects a powered-down laptop, but once the system is on and the operating system is loaded, many such products transparently decrypt files for whoever is logged in, ransomware included.
• Destruction. HHS excludes redaction as a means of destruction; media must be cleared, purged or destroyed consistent with NIST SP 800-88.

The encryption guidance still cites FIPS 140-2 and was last reviewed in 2013; read it as written.

Owner: the system owner and the security lead. Verify: the key location, the encryption mode and the system's power state at the time of the incident are written down.

Step 2: When did the clock start?

The clock starts the first day a breach is known, or would have been known with reasonable diligence, to a workforce member or agent other than the person who committed it. HHS's 2009 preamble says time runs "when the incident is first known, not when the investigation of the incident is complete, even if it is initially unclear whether the incident constitutes a breach." 60 calendar days is an outer limit, and the standard is "without unreasonable delay" (45 CFR 164.404(b)).

HHS gives two benchmarks. An investigation unreasonably allowed to lag 30 days is an unreasonable delay. If the information needed for letters was compiled on day 10, waiting until the outer limit is also unreasonable. HHS defines reasonable diligence as "business care and prudence," and expects entities to have "reasonable systems for discovery of breaches." That is the standard you write your incident response plan against (see our incident response plan guide).

Which signal fixes the date. The table is our analysis of how a regulator could read the rule; it is not HHS guidance.

Write the discovery date as the earliest defensible signal, with a note on why it qualifies. Letting it move later because "we weren't sure yet" is the error HHS's preamble addresses directly.

The enforcement example. OSF Healthcare discovered ransomware-infected files on April 23, 2021. It determined on August 24, 2021 that the attackers had stolen PHI of 53,907 patients, and notified patients and HHS on October 1, 2021: 38 days after the determination, 161 days after discovery. In a resolution agreement signed July 1, 2026 and announced July 29, 2026, OCR cited late notice to individuals and to HHS and set a payment of $552,250. OSF did not admit liability. The agreement does not say why notice was late; our reading is that the clock ran from April 23, because the 38 days from determination would otherwise be well inside 60 days. (The 2017 Presence Health settlement was the first such case.)

Business associates. If a business associate acts as your agent, its discovery is imputed to you, and your clock may have started before you heard. If it is an independent contractor, your clock runs from the day it notifies you. The test is the right to control its conduct. Labels do not decide it: a contract that calls the vendor an independent contractor does not control, and the authority to give interim instructions points to agency. If your only recourse is to amend the contract or sue, that generally indicates no agency. A BA must itself notify you without unreasonable delay and within 60 calendar days of its discovery, and the business associate agreement (BAA) must require it to report security incidents. HHS says covered entities may wish to address timing in the contract. Our recommendation: set a much shorter BAA window than 60 calendar days, and treat any vendor you direct day to day as your agent. In March 2026 OCR settled with business associate MMG Fusion over potential violations that, OCR said, included failing to notify the covered entities affected.

Step 3: Is it a breach, or can you document that it is not?

An impermissible use or disclosure is presumed a breach unless you demonstrate a low probability that the PHI was compromised, based on a risk assessment of at least four factors. The entity bears the burden of proving either that all notifications were made or that the incident was not a breach (45 CFR 164.414(b)). HHS expects assessments "thorough, completed in good faith," with reasonable conclusions. Notifying without an assessment is permitted.

Three exceptions remove the presumption, and you must document why one applies:

1. Unintentional access or use by a workforce member, in good faith and within the scope of authority, that does not lead to further impermissible use or disclosure.
2. Inadvertent disclosure between people authorized to access PHI at the same covered entity or business associate (or organized health care arrangement), where the recipient does not further use or disclose it impermissibly.
3. A good-faith belief that the recipient could not reasonably have retained the information.

Ransomware. HHS's 2016 fact sheet says that when ePHI is encrypted by ransomware, a breach has occurred because the ePHI was acquired, unless you can demonstrate a low probability of compromise. It lists the evidence to weigh: the malware's type and variant, its steps, and communications including exfiltration attempts. It also encourages entities to weigh high risk to the availability or integrity of the data, which may indicate compromise, and says whether PHI was exfiltrated should also be considered.

A filled record. Hypothetical case, for illustration only (no real organization or incident): ransomware encrypts a file server holding ePHI for 4,200 patients at a physician group. This is how the four factors come out.

Other records end differently. If a file goes by mistake to a colleague at the same covered entity who is also authorized to access PHI, and the colleague did not use or pass it on further, exception 2 can apply; the record names the exception, why it fits, and how you confirmed there was no further use.

Who signs the no-notice decision. We found no HHS source that names a role. Our recommendation: the privacy officer signs, with the CISO attesting to the technical findings and counsel reviewing before filing. Nobody on the incident team should sign alone.

Correction box: two different assessments. The breach risk assessment above (164.402) decides whether to notify after an incident. The Security Rule risk analysis (164.308(a)(1)(ii)(A)) is an accurate and thorough assessment of risks to ePHI, done ahead of time. "HIPAA risk assessment" guides often conflate them. Completing the second does not satisfy the first.

Step 4: Who must be told, and by when?

Individuals, HHS and sometimes the media, each with its own trigger. Notice to individuals is due without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404(b)). The HHS and media triggers use different counts, so check each separately.

The two thresholds differ. A breach can reach the HHS threshold while no one state's residents reach the media threshold, so it needs an HHS report but no media notice. HHS's reporting page also says 60 days from discovery for 500 or more individuals; the rule text says contemporaneously, so file with the letters. File one HHS report per breach through the HHS breach portal, give an estimate if the count is unsure, and add an addendum later. A business associate may file for the covered entity, and individual notice may be delegated to it, but the covered entity stays responsible for ensuring individuals are notified.

Law-enforcement delay (164.412). If a law enforcement official says notice would impede a criminal investigation or damage national security, a written statement lets you delay for the period it specifies. An oral statement lets you delay no more than 30 days from that statement, unless a written statement arrives in that time; document it, including the official's identity.

Sample calendar. Discovery on Monday, June 1, 2026 (day 0).

If a business associate discovered it, the covered entity's day 0 depends on the agency test in Step 2.

Owner of each step: privacy officer for letters, the portal and the media notice; security lead for the evidence file; counsel for law-enforcement requests. Verify: each notice has a dated copy, a mailing record and, for substitute notice, a screenshot of the web posting with its date.

How to write the HIPAA breach notification letter

Each paragraph below maps to one required element of 164.404(c), in plain language. Element A needs the date of the breach and the date of discovery, if known. The letter may go in more than one mailing as information arrives.

For state-specific fields, see the state guides below.

What to keep for an OCR inquiry

HIPAA requires documentation sufficient to meet your burden of proof, kept for six years from its creation or the date it last was in effect, whichever is later (45 CFR 164.530(j)). In practice:

• The discovery-date note: signals, timestamps, who knew what.
• The four-factor record, or the exception relied on, with the evidence list: HHS names the documentation of the risk assessment demonstrating the conclusions reached.
• Copies of each letter, mailing proof, website posting dates and the toll-free line's 90-day log.
• The HHS submission confirmation, and the small-breach log.
• Law-enforcement statements, written or the dated oral note.
• Breach policies and training records. HHS requires written breach notification procedures, workforce training and sanctions.

Where an AI agent can help. An agent can assemble the discovery timeline from SIEM and ticket data, pull the file-access and egress logs for factor 3, and draft the letter from your inventory. A human signs the discovery date and the assessment conclusion.

Which other rules apply on top of HIPAA?

State breach laws still apply. They may set shorter deadlines or require attorney general notice, and some treat HIPAA-compliant notice as compliant; see our guides for California, New York and Florida. Health apps and vendors outside HIPAA may instead fall under the FTC Health Breach Notification Rule, 16 CFR Part 318, which excludes HIPAA covered entities and entities acting as their business associates. Public healthcare companies may also have to file an SEC Form 8-K under Item 1.05 within four business days of determining that a cybersecurity incident is material.

Did the breach rules change in 2026?

One change widens who follows the rules; nothing has changed the rules themselves. Since February 16, 2026, Part 2 substance use disorder programs follow the same breach rules for unsecured Part 2 records, and HHS's reporting page now covers them. As of November 9, 2026, the breach notification provisions of 45 CFR 164.400-414 have not been amended since 2013. HHS's January 2025 Security Rule proposal is still only a proposal; the current Unified Agenda (the 2026 edition) lists it as a long-term action with a final action target of July 2027, and HHS says it would not alter business associates' breach reporting duties.