HIPAA Breach Notification Rule: Deadlines and Examples

The HIPAA Breach Notification Rule requires a covered entity that discovers a breach of unsecured protected health information (PHI) to notify each affected person "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach," to notify HHS, and to notify prominent media outlets when the breach involves more than 500 residents of a state or jurisdiction (45 CFR 164.404; 164.406; 164.408). A business associate must notify the covered entity within the same outer limit (164.410). HHS says the rule can apply when PHI goes to a tracking technology vendor without a BAA (HHS). Curve Compliance signs a BAA on every plan and strips PHI before data reaches an ad platform, so ad platforms never receive it.

Book a call. Curve Compliance sends conversions to your ad platforms server-side, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call with Curve.

What counts as a breach

The rule covers breaches "occurring on or after September 23, 2009" (45 CFR 164.400). Section 164.402 defines a breach as "the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information" (eCFR). HHS reads that as "an impermissible use or disclosure under the Privacy Rule" (HHS). Such a use or disclosure "is presumed to be a breach" unless the covered entity or business associate "demonstrates that there is a low probability that the protected health information has been compromised," based on a risk assessment of at least four factors (eCFR):

• What data. "The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification"
• Who received it. "The unauthorized person who used the protected health information or to whom the disclosure was made"
• Whether it was seen. "Whether the protected health information was actually acquired or viewed"
• Mitigation. "The extent to which the risk to the protected health information has been mitigated"

HHS adds that covered entities and business associates "have discretion to provide the required breach notifications following an impermissible use or disclosure without performing a risk assessment" (HHS). Under 164.414 the covered entity or business associate has "the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach" (eCFR). Whether a given incident needs notice turns on its facts, so talk to your counsel.

The three exceptions

Section 164.402 excludes three situations from the definition of breach (eCFR):

• Good-faith workforce access. Unintentional access or use by a workforce member or person acting under the entity's authority, if it "was made in good faith and within the scope of authority," with no further impermissible use or disclosure.
• Inadvertent internal disclosure. A disclosure by a person authorized to access PHI "to another person authorized to access protected health information at the same covered entity or business associate," or organized health care arrangement, again with no further impermissible use or disclosure.
• The recipient could not keep it. A disclosure where there is "a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information."

Who to notify and when

Who	Deadline	How	Rule
Affected individuals	Without unreasonable delay; 60 calendar days after discovery at most	First-class mail, or email if the person agreed. If contact details are out of date for 10 or more people, a website posting for 90 days or major media notice, with a toll-free number	164.404
HHS, 500 or more individuals	"contemporaneously with the notice required by" 164.404(a) (eCFR)	HHS's online breach reporting portal (HHS)	164.408(b)
HHS, fewer than 500 individuals	Logged, then "not later than 60 days after the end of each calendar year" (eCFR)	Same portal; HHS says "You do not have to wait until the end of the year" (HHS)	164.408(c)
Media, more than 500 residents of a state or jurisdiction	60 calendar days after discovery at most	"prominent media outlets serving the State or jurisdiction" (eCFR)	164.406
Business associate to covered entity	60 calendar days after discovery at most	Identify each affected individual, to the extent possible	164.410
Law enforcement delay	As long as a written request specifies; an oral one "no longer than 30 days" unless put in writing (eCFR)	Document an oral request and who made it	164.412

The clock starts at discovery: the first day the breach "is known to the covered entity, or, by exercising reasonable diligence would have been known" to it (eCFR). The notice must be "written in plain language" and say what happened, what PHI was involved, what people should do and how to reach the entity (eCFR). OCR says it "investigates all breaches of protected health information (PHI) and Part 2 records that affect 500 or more individuals" (OCR breach portal).

Unsecured PHI

The duty applies only to unsecured PHI, meaning PHI "not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary" (eCFR). HHS's guidance "specifies encryption and destruction as the technologies and methodologies" that do this, and entities that secure information that way "are relieved from providing notifications following the breach of such information" (HHS). Encryption counts only if the key "has not been breached" (HHS guidance). For which data elements make website data PHI, see the 18 HIPAA identifiers in website data.

Tracking pixels and breach reports

HHS's tracking bulletin lists breach notification among the duties that apply to tracking technologies. A regulated entity must notify affected individuals, HHS and, when applicable, the media "of an impermissible disclosure of PHI to a tracking technology vendor that compromises the security or privacy of PHI when there is no Privacy Rule requirement or permission to disclose PHI and there is no BAA with the vendor." In that case "there is a presumption that there has been a breach of unsecured PHI" unless a low probability of compromise is shown (HHS). See also breach liability for clinic marketing teams.

HHS's notice on the bulletin says a federal court in Texas vacated part of it on June 20, 2024, for IP addresses tied to visits to unauthenticated public pages about health conditions or providers, and "HHS is evaluating its next steps in light of that order" (HHS). The breach passage above remains on the page. See the bulletin annotated after AHA v. Becerra.

Enforcement of the notice duties

Regulators enforce the notice duties themselves. HHS lists a November 26, 2019 resolution titled "OCR Secures $2.175 Million HIPAA Settlement After Hospitals Failed to Properly Notify HHS of a Breach of Unsecured Protected Health Information" (HHS), in which Sentara Hospitals settled "potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification and Privacy Rules" (HHS). Connecticut's attorney general and 32 other attorneys general settled with health care clearinghouse Inmediata, which "delayed notification to impacted consumers for over three months and sent misaddressed notices" (Connecticut AG). For patient lawsuits over pixels, see the pixel lawsuit tracker.

HIPAA's rule vs the FTC Health Breach Notification Rule

Companies HIPAA does not cover can fall under the FTC's rule instead. The FTC says it "requires vendors of personal health records and related entities to notify consumers following a breach involving unsecured information" (FTC), and 16 CFR 318.1 says it "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity" (eCFR).

Point	HIPAA Breach Notification Rule	FTC Health Breach Notification Rule
Who it covers	Covered entities and business associates (HHS)	Vendors of personal health records, PHR related entities and third party service providers (318.1)
Trigger	A breach of unsecured PHI (164.402)	A breach of security of unsecured PHR identifiable health information, including acquisition "that occurs as a result of a data breach or an unauthorized disclosure" (318.2)
Notice to individuals	60 calendar days after discovery at most (164.404)	60 calendar days after discovery at most (318.4)
Notice to the regulator	HHS: with individual notice at 500 or more; yearly under 500 (164.408)	FTC: with individual notice at 500 or more; yearly under 500 (318.4)
Media notice	More than 500 residents of a state or jurisdiction (164.406)	500 or more residents of a state or jurisdiction (318.3)
Enforced by	HHS Office for Civil Rights (HHS)	FTC; violations are "subject to civil penalties" (318.7)

For who the FTC rule reaches in practice, see the FTC Health Breach Notification Rule guide. For how federal rules meet state law, see does HIPAA preempt state law.

How Curve Compliance helps

Curve Compliance signs a BAA on every plan and replaces browser ad pixels with one script that sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.

Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. To find pixels still firing on booking or intake pages, run the free website scan and see how to remove the Meta pixel.

Sources, checked October 26, 2026: 45 CFR 164.400; 164.402; 164.404; 164.406; 164.408; 164.410; 164.412; 164.414; 16 CFR 318.1; 318.2; 318.3; 318.4; 318.7; HHS breach rule; HHS breach reporting; HHS unsecured PHI guidance; HHS tracking bulletin; HHS resolution agreements; Sentara; Warby Parker; HHS state AGs; OCR breach portal; FTC rule page; Connecticut AG.

Frequently Asked Questions

What is the HIPAA Breach Notification Rule?

It is the rule at 45 CFR 164.400 to 164.414 that requires covered entities and business associates to give notice after a breach of unsecured PHI (HHS). Covered entities notify affected people, HHS and, when more than 500 residents of a state or jurisdiction are affected, the media (eCFR).

How many days to notify of a HIPAA breach?

No later than 60 calendar days after discovery for individuals and the media, and "without unreasonable delay," so 60 days is an outer limit (45 CFR 164.404; 164.406). HHS gets notice at the same time for breaches of 500 or more people, and within 60 days after the end of the calendar year for smaller ones (45 CFR 164.408).

What is considered a breach under the breach notification rule?

An acquisition, access, use or disclosure of PHI that the Privacy Rule does not permit and that compromises its security or privacy (45 CFR 164.402). It is presumed a breach unless a risk assessment shows a low probability of compromise.

What are the three exceptions to the HIPAA breach notification rule?

Unintentional, good-faith access or use by a workforce member acting within their authority; inadvertent disclosure between people authorized to access PHI at the same organization; and disclosure to someone who "would not reasonably have been able to retain such information" (45 CFR 164.402). In the first two, the PHI must not be used or disclosed further in a way the Privacy Rule does not permit.

Does HIPAA include a breach notification rule?

Yes. HHS says the rule at 45 CFR 164.400 to 164.414 "requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information" (HHS).

How is a breach defined under the breach notification rule?

As an impermissible acquisition, access, use or disclosure "which compromises the security or privacy of the protected health information," subject to three exclusions (45 CFR 164.402).

Who enforces HIPAA privacy security breach notification rules?

The HHS Office for Civil Rights: "OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules" (HHS). State attorneys general can also bring civil actions for violations of the HIPAA Privacy and Security Rules (HHS); see who enforces HIPAA.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.