What is the HIPAA Breach Notification Rule?

What is the purpose of the rule?

According to HHS, the rule makes sure that individuals learn when their unsecured protected health information (PHI) has been compromised, so they can protect themselves, and that HHS learns about breaches so it can oversee compliance. It applies to covered entities (health plans, health care clearinghouses and most health care providers) and to business associates that handle PHI on their behalf.

Who must be notified

• Individuals. HHS says covered entities must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovering the breach, by first-class mail or by email if the individual has agreed to it.
• The media. For a breach affecting more than 500 residents of a state or jurisdiction, HHS says covered entities must also notify prominent media outlets serving that area, within the same time limit.
• HHS. Breaches affecting 500 or more individuals must be reported to the Secretary of HHS within the same time limit as individual notice. Smaller breaches may be logged and reported to HHS within 60 days of the end of the calendar year.
• Covered entities, by business associates. A business associate that discovers a breach must notify the covered entity, which then handles notice.

How long do you have to report a HIPAA breach?

The outside limit HHS describes is 60 calendar days from discovery for individual notice, media notice and reports to HHS of breaches affecting 500 or more people. Notice must not be delayed unreasonably just because the 60 days have not run out. State breach notification laws can set their own timing; see the state law index.

The breach risk assessment

HHS explains that an impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity or business associate shows a low probability that the PHI has been compromised, based on a risk assessment of at least four factors:

1. the nature and extent of the PHI involved, including identifiers and likelihood of re-identification;
2. the unauthorized person who used the PHI or to whom it was disclosed;
3. whether the PHI was actually acquired or viewed; and
4. the extent to which the risk to the PHI has been mitigated.

The rule covers unsecured PHI. HHS guidance describes encryption and destruction methods that render PHI unusable to unauthorized people; breaches of PHI secured that way do not trigger notice.

How to report a HIPAA breach

Covered entities report breaches to HHS through the online form linked from the HHS breach reporting page. Reports of 500 or more individuals are then published on the OCR breach portal, which our HIPAA breach tracker mirrors (8,024 reports, latest Sep 30, 2026). Individuals who think their health information was mishandled can file a complaint with OCR.

See also what is a HIPAA breach and HIPAA breach penalties.