Step one: is it a breach at all?
Not every incident is a reportable breach. A breach is an impermissible acquisition, access, use or disclosure of unsecured PHI that compromises its security or privacy. Two things take an incident out of the rule before you reach the clock.
- The safe harbor. If the PHI was encrypted in line with HHS guidance, or properly destroyed, it isn't unsecured. A lost encrypted laptop is a bad afternoon and an entry in the incident log, not a notification event.
- The four-factor assessment. For unsecured PHI, an impermissible disclosure is presumed to be a breach unless you can show, in writing, a low probability that the PHI was compromised, considering the nature of the data, who got it, whether it was actually viewed, and how far you've mitigated it.
Three narrow exceptions also exist: unintentional good-faith access by a workforce member, inadvertent disclosure between authorized people at the same entity, and a disclosure where the recipient couldn't reasonably retain the information. Document the reasoning either way, because OCR will ask for the assessment, not only the decision.
Step two: the clock
Discovery is the first day the breach is known, or would have been known with reasonable diligence, to anyone at your organization other than the person who caused it. The investigation doesn't pause the clock.
Your notice deadlines
Enter the date of discovery.
Sixty days is the outer limit. The rule says "without unreasonable delay", and HHS has said that waiting until day 60 without a reason can itself be an unreasonable delay. State breach laws can be shorter; several require notice within 30 or 45 days.
Who gets told, and how
| Recipient | When | How |
|---|---|---|
| Each affected individual | Without unreasonable delay, no later than 60 days after discovery | First-class mail, or email if the person agreed to it. Substitute notice (website posting for 90 days or major media, plus a toll-free number) if you can't reach 10 or more people. |
| HHS, 500 or more people | Same 60 days | OCR's online breach portal. The breach appears on the public list. |
| HHS, fewer than 500 | Within 60 days after the end of the calendar year of discovery | Same portal. Keep a log during the year. |
| Prominent media | Same 60 days, if more than 500 residents of a state or jurisdiction are affected | Press release to outlets serving that state. |
| Covered entity, from a business associate | No later than 60 days after the BA discovers it, usually much sooner under the BAA | As the BAA specifies, with the identity of each affected person where known. |
| State attorney general | Varies by state | Many states require notice to the AG above a threshold, on their own timelines. |
You can't backdate a notice. You can backdate almost nothing else in HIPAA either.Your engineer
What the notice has to say
In plain language: what happened and when it was discovered, what kinds of information were involved, what the person should do to protect themselves, what you're doing to investigate, mitigate and prevent a repeat, and how to contact you, including a toll-free number, email, website or postal address. Templates help. Vague notices draw complaints, and complaints draw investigations.
The mistakes OCR has actually penalized
- Notifying late. A 2025 settlement with a small imaging practice cited both a missing risk analysis and a breach notice sent after the 60-day deadline.
- Deciding it wasn't a breach without writing down why. No four-factor assessment on file reads as no assessment at all.
- Forgetting the under-500 log. The year-end submission is the one practices most often skip.
- Waiting for the forensics report. Investigations can run months. The clock doesn't.
If HIPAA doesn't apply to you
Consumer health apps and devices outside HIPAA fall under the FTC's Health Breach Notification Rule, which has its own 60-day outer limit and its own FTC notice. If a provider offers your app to patients, you're usually a business associate instead, and this page applies.
With AccuSights: the incident plan is written and rehearsed, the breach log and the four-factor assessment template live in the platform, and when something happens your engineer is on the call, not a ticket queue.