Breach Notification Rule
Also known as: HIPAA Breach Notification Rule
The HIPAA rule requiring notice when unsecured PHI is exposed.
The Breach Notification Rule sets who must be told when unsecured protected health information (PHI) is breached, and how fast. It sits alongside the Privacy and Security Rules, at 45 CFR §§ 164.400 to 164.414.
Under the HIPAA Breach Notification Rule, who notifies whom depends on your role:
Covered entities notify individuals without unreasonable delay, and no later than 60 calendar days after discovery (§ 164.404).
Covered entities notify HHS. For 500 or more people, HHS is told at the same time as the individuals. Smaller breaches are logged and reported within 60 days after the calendar year ends (§ 164.408).
Covered entities notify the media when a breach involves more than 500 residents of a state or jurisdiction. Prominent outlets there must be told within 60 days of discovery (§ 164.406).
Business associates notify the covered entity, within the same 60-day ceiling, and identify each affected person where possible (§ 164.410). The covered entity then owes the notices above.
Sixty days is a ceiling, not a target. A business associate agreement can set a shorter reporting window, as our guide to breach reporting under a BAA explains.
Accidental disclosures can trigger it too. See examples of unintentional HIPAA violations.
Source: 45 CFR Part 164, Subpart D, on law.cornell.edu.