The HIPAA Breach Notification Rule requires a covered entity to notify every affected patient within 60 calendar days of discovering a breach of unsecured protected health information. Breaches of 500 or more people also go to HHS at the same time, and to the media when more than 500 residents of one state are hit. In California, state law shortens the patient deadline to 30 calendar days.
A breach rarely announces itself. A laptop goes missing from a car, a staff member emails a chart to the wrong patient, or a ransomware note appears on the front desk computer. From that moment, a federal clock is running. This guide explains how to decide whether an incident is a reportable breach, who you must tell, the exact deadlines, what the letter must say, and how California law changes the plan for a Los Angeles practice. Every rule below links to its source. Updated October 2026.
What the HIPAA Breach Notification Rule requires
The rule lives at 45 CFR 164.400 through 164.414. It applies to covered entities, such as medical and dental practices, health plans and clearinghouses, and to their business associates, the outside vendors that create, receive, keep or send patient data for them. HHS summarizes it on its Breach Notification Rule page.
One word decides whether the rule applies at all: unsecured. Under 45 CFR 164.402, unsecured PHI is information that has not been made unusable, unreadable or indecipherable to unauthorized people using a method HHS has named in guidance. If the PHI was secured that way, its loss does not trigger notification.
HHS names only two methods in its guidance on rendering PHI unusable: encryption and destruction. Encryption counts when data at rest is protected consistent with NIST SP 800-111 and data in motion with NIST SP 800-52, 800-77 or 800-113 (or FIPS 140-2 validated modules), and when the key has not been breached. HHS adds that keys should be stored apart from the data they protect. For destruction, paper must be shredded so it cannot be read or rebuilt (redaction does not count), and electronic media must be cleared, purged or destroyed under NIST SP 800-88.
That is why encryption is the closest thing HIPAA has to breach insurance. A stolen laptop with full disk encryption and an uncompromised key is a lost device, not a reportable breach. The same laptop without encryption can mean hundreds of letters, an HHS report and a news release.
When unsecured PHI is compromised, the rule can require notice to three audiences: the affected individuals, the Secretary of HHS, and in larger cases the media. Getting the notice wrong is its own violation. Under 45 CFR 164.414, your practice carries the burden of proving that every required notice went out, or that the incident was not a breach. HHS sets penalty ranges by level of culpability under 45 CFR 160.404, from violations you did not know about to willful neglect left uncorrected, with amounts adjusted for inflation each year.
Is it actually a breach? The four-factor risk assessment
Not every mistake with patient data is a reportable breach, but the rule starts from the opposite assumption. Under 45 CFR 164.402, any use or disclosure of PHI that the Privacy Rule does not permit is presumed to be a breach. Your practice can overcome that presumption only by showing, through a risk assessment, that there is a low probability the PHI was compromised. The assessment must weigh at least these four factors.
| Factor in 164.402 | The question to answer | What lowers the risk |
|---|---|---|
| The nature and extent of the PHI, including identifiers and the chance of re-identification | What was exposed, and how easily could it be tied to a person? | Limited data, such as an appointment time with no diagnosis, Social Security number or insurance ID |
| The unauthorized person who used or received the PHI | Who got it? | A recipient that is itself bound by HIPAA, such as another covered entity |
| Whether the PHI was actually acquired or viewed | Is there evidence anyone opened it? | Forensic proof that a file was never accessed, or a returned device that was never powered on |
| How far the risk has been mitigated | What have you done since? | Prompt recovery, or credible written assurance from the recipient that the data was destroyed |
If the documented assessment shows a low probability of compromise, notification is not required. If it does not, the incident is a breach. HHS also notes that a practice may skip the assessment and simply notify. Either way, write it down. The burden of proof sits with you, and 45 CFR 164.530(j) requires you to keep that documentation for six years. A blank four-factor worksheet belongs in your HIPAA compliance checklist so nobody is designing the form during an incident.
The three exceptions to the breach definition
The definition in 164.402 also excludes three narrow situations. The first is an unintentional access or use by a workforce member acting in good faith and within their authority. The second is an inadvertent disclosure from one authorized person to another authorized person at the same covered entity, business associate or organized health care arrangement. In both cases the information cannot be used or disclosed further. The third is a disclosure where you have a good faith belief the recipient could not reasonably have kept the information, such as a letter returned unopened by the post office. Apply these carefully. They are not a way to avoid a notice you would otherwise owe.
Who you must notify, and when
Every deadline runs from discovery. Under 45 CFR 164.404(a)(2), a breach is treated as discovered on the first day it is known to your practice, or would have been known with reasonable diligence. Knowledge of any workforce member or agent, other than the person who committed the breach, counts as your knowledge. So the clock can start when a front desk employee notices something odd, not when the owner hears about it.
| Who must be notified | When it applies | Federal deadline | How |
|---|---|---|---|
| Affected individuals | Every breach of unsecured PHI | Without unreasonable delay, and no later than 60 calendar days after discovery (164.404) | First class mail, or email if the person agreed to electronic notice |
| HHS Office for Civil Rights | 500 or more individuals | At the same time as individual notice, so within the same 60 days (164.408(b)) | Online breach report form on the HHS website |
| HHS Office for Civil Rights | Fewer than 500 individuals | No later than 60 days after the end of the calendar year in which the breach was discovered (164.408(c)) | Same HHS form, from a log you keep during the year |
| Prominent media outlets | More than 500 residents of one state or jurisdiction | Without unreasonable delay, and no later than 60 calendar days after discovery (164.406) | Usually a press release to outlets serving that area |
| Your practice, from a business associate | The breach happens at or by a vendor | Without unreasonable delay, and no later than 60 calendar days after the vendor discovers it (164.410) | As set out in the business associate agreement |
Notifying affected individuals
Each person whose unsecured PHI was breached must get written notice by first class mail at their last known address, or by email if they agreed to electronic notice. If you have out of date contact details for 10 or more people, 164.404(d) requires substitute notice: either a conspicuous posting on your website home page for 90 days or notice in major print or broadcast media where they likely live, plus a toll-free number that stays active for at least 90 days. For fewer than 10 people, a phone call or another written notice is enough. If there is a risk of imminent misuse, you may also call patients right away, on top of the written notice.
Notifying HHS
Breach reports go to the Secretary through the HHS breach reporting form. The size of the breach sets the timing. For 500 or more individuals, 164.408(b) says the report goes in at the same time as the individual letters. For fewer than 500, you keep a log and submit each breach within 60 days after December 31 of the year you discovered it, which lands on or around March 1. Large breaches are also published: HHS lists every breach of 500 or more on its public breach portal.
Notifying the media
Under 45 CFR 164.406, a breach involving more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area, on the same 60 day outer limit, with the same content as the patient letter. The count is per state. A breach of 600 patients who all live in California triggers media notice in California. A breach of 900 people split between several states may not trigger it anywhere.
When the breach happens at a business associate
If your billing company, cloud host or IT provider has the breach, 45 CFR 164.410 requires it to tell you without unreasonable delay and no later than 60 days after it discovers the breach. It must identify each affected person where possible and hand over the facts you need for your letters. Your practice remains responsible for making sure patients are notified, although HHS says you may delegate the mailing to the vendor. A federal maximum of 60 days for the vendor can leave you almost no time, which is why your business associate agreement should set a much shorter reporting window and say who sends the letters.
When law enforcement asks you to wait
Under 45 CFR 164.412, if a law enforcement official says notice would impede a criminal investigation or harm national security, you delay. A written statement that names a time period controls for that period. An oral statement must be documented, including who made it, and the delay can last no longer than 30 days from that statement unless a written one arrives in the meantime.
What a breach notification letter must contain
The patient letter is not free form. Under 164.404(c), it must be written in plain language and include, to the extent possible: a brief description of what happened, with the date of the breach and the date of discovery; the types of unsecured PHI involved, such as name, Social Security number, date of birth, address, account number or diagnosis; steps people should take to protect themselves; what your practice is doing to investigate, reduce harm and prevent a repeat; and how to reach you, which must include a toll-free number, an email address, a website or a postal address.
California adds a format. Civil Code 1798.82(d) requires a notice titled "Notice of Data Breach" with set headings. But 1798.82(e) says a HIPAA covered entity that fully complies with the federal HITECH notice rules is deemed to meet that format requirement. It does not excuse you from the rest of the section, including its deadline.
The 72-hour myth: what the proposed Security Rule changes
You may have read that HIPAA now requires breach notification within 72 hours. It does not. No HIPAA rule, current or proposed, sets a 72 hour deadline for notifying patients or HHS. The figure comes from other regimes and keeps getting copied into HIPAA articles by mistake.
What HHS actually proposed, in a Notice of Proposed Rulemaking published January 6, 2025, is different. It would require written procedures to restore critical systems and data within 72 hours of a loss, and it would require business associates to tell covered entities within 24 hours of activating their contingency plans. HHS states that the change would not alter a business associate's breach reporting duty. Those are recovery and vendor oversight timelines. Our guide to the HIPAA Security Rule covers the rest of the proposal.
It is still a proposal. As of October 25, 2026, the Federal Register shows no final rule for it, and the Fall 2025 Unified Agenda listed final action for July 2027. The binding federal deadline for patient letters and large breach reports remains 60 days. Building the ability to detect and respond within days is still smart, and in California it is close to required, as the next section shows.
California breach laws that are stricter than HIPAA
HIPAA is a federal floor. When a state law also applies, your practice must meet both, and in practice the shorter deadline sets your schedule. California has three laws a Los Angeles practice needs to know.
The first is the general breach law, Civil Code 1798.82. As amended by SB 446, effective January 1, 2026, it requires notice to affected California residents within 30 calendar days of discovery or notification of the breach. The law allows a delay for law enforcement, or as needed to determine the scope of the breach and restore the system. If you notify more than 500 California residents from one breach, you must send a sample copy of the notice to the Attorney General within 15 calendar days of notifying them. Medical information and health insurance information are on the law's list of personal information when paired with a name. Like HIPAA, it exempts encrypted data unless the key or credential was also taken.
The second is Health and Safety Code 1280.15. It applies to clinics, health facilities, home health agencies and hospices licensed under the sections it lists. They must report any unlawful or unauthorized access, use or disclosure of a patient's medical information to the California Department of Public Health and to the affected patient no later than 15 business days after detecting it. Late reports can draw a penalty of $100 per day, and the combined penalties under the section are capped at $250,000 per reported event. A private physician or dental practice that is not licensed under one of those sections generally falls outside 1280.15, so check your license type with counsel.
The third is the Confidentiality of Medical Information Act. Under Civil Code 56.36, a patient can sue for a negligent release of their medical information and recover nominal damages of $1,000 without proving any actual harm, plus actual damages. The section gives HIPAA covered entities a narrow defense that removes the nominal damages, but only when every required notice was made, the release went solely to another covered entity or business associate, and the provider had taken listed precautions, including encryption. Timely notice is part of your legal defense in California.
| Requirement | HIPAA (federal) | California |
|---|---|---|
| Notify affected individuals | No later than 60 calendar days after discovery | Within 30 calendar days of discovery under Civil Code 1798.82; within 15 business days of detection for licensed clinics and facilities under Health and Safety Code 1280.15 |
| Notify a regulator | HHS at the same time as patients for 500 or more; within 60 days after year end for smaller breaches | Attorney General sample notice within 15 calendar days of notifying residents when more than 500 Californians are notified; CDPH within 15 business days for licensed clinics and facilities |
| Encrypted data | Not reportable if encrypted to HHS guidance and the key was not breached | Not reportable under 1798.82 unless the key or credential was also acquired |
| Patient lawsuits | No private right of action under HIPAA | CMIA allows suits for negligent release, with $1,000 nominal damages plus actual damages |
| Which deadline governs | Both apply | Plan around 30 days, not 60 |
A worked example: one stolen laptop at a small LA practice
This is a hypothetical example to show how the deadlines stack. It is not a real client and not legal advice. Picture a 10 person dental practice in Los Angeles that is not a licensed clinic. On a Monday, Day 0, the office manager learns that an associate's laptop was stolen from a car over the weekend. The laptop holds a spreadsheet with names, dates of birth, insurance IDs and treatment notes for 1,200 patients, all California residents.
| Day | What happens | Rule driving it |
|---|---|---|
| Day 0 | Discovery. Manager records date and time, remote wipe is attempted, passwords for the associate's accounts are reset | Clock starts under 164.404(a)(2) and Civil Code 1798.82 |
| Day 1 to 3 | IT confirms whether full disk encryption was on and whether the key was stored on the device | Encryption decides whether PHI was secured (HHS guidance; 1798.82(a)) |
| Day 3 to 7 | Four-factor risk assessment written up. If the laptop was encrypted and the key safe, the file is closed and documented. If not, it is a breach | 164.402; documentation kept six years under 164.530(j) |
| By Day 30 | Letters mailed to all 1,200 patients, in plain language with the required elements | California's 30 day limit beats HIPAA's 60 |
| By Day 30 | HHS report filed at the same time as the letters, because 500 or more people are affected | 164.408(b) |
| By Day 30 | Press release to prominent Los Angeles and California outlets, because more than 500 California residents are affected | 164.406 (federal limit is Day 60, but sending it with the letters keeps the story consistent) |
| Within 15 days of the letters | Sample copy of the letter submitted to the California Attorney General | 1798.82(f) |
| Ongoing | Root cause fixed, encryption enforced on every device, security risk analysis updated | Security Rule risk management |
Change one fact and the plan changes. If the spreadsheet held 300 patients instead, the letters are still due by Day 30, but there is no media notice and no Attorney General sample, and the HHS report goes on the annual log, due within 60 days after the end of the year. If the practice were a licensed clinic, CDPH and the patients would need notice within 15 business days, which is the tightest deadline in the table. And if the laptop had been encrypted with the key kept elsewhere, none of the letters would be required.
What to do when ePHI is compromised: step by step
A calm, ordered response protects patients and your practice. The table below is the sequence we recommend building into your incident response plan before you need it.
| Step | What to do | Why it matters |
|---|---|---|
| 1. Contain | Disconnect the affected device, disable the compromised account, recall the misdirected email | Limits the number of people affected and counts as mitigation in the risk assessment |
| 2. Preserve evidence | Keep logs and system images; do not wipe or rebuild too early; write down the discovery date and time | The assessment and any investigation depend on it, and the date starts every clock |
| 3. Assemble the team | Practice owner, privacy or security official, IT provider, and counsel for anything serious | Decisions on notice need both legal and technical input |
| 4. Assess and document | Work through the four factors and record the conclusion either way | You carry the burden of proof under 164.414 |
| 5. Identify everyone affected | Build the list of names, addresses and states of residence | Drives letter content, the 500 thresholds and the per state media count |
| 6. Notify on time | Patients, HHS and media as required; in California, plan to 30 days, and 15 business days for licensed facilities | Late or incomplete notice is a separate violation |
| 7. Fix the root cause | Close the gap that allowed it: missing encryption, no MFA, unpatched system, untrained staff | OCR looks at whether you corrected the problem |
| 8. Keep the records | Incident file, assessment, copies of notices, corrective actions | Retain for six years under 164.530(j) |
Most breaches at small practices start with preventable causes such as phishing, reused passwords and unpatched systems. Treat every incident as a finding for your next security risk assessment, and update the analysis to match what you learned.
How to reduce both the risk and the cost of a breach
Two things run through every section above, and both are in your control.
The first is encryption. Because the rule turns on the word unsecured, encrypting laptops, phones, backups and data in transit is the single most effective way to shrink your notification exposure. The proof matters as much as the setting: you need records showing the device was encrypted on the day it went missing and that the key was not with it. Encryption has limits. If the attacker also got the password or the key, the data is not secured, and encryption does nothing about a logged in user misusing records or a phishing victim handing over credentials.
The second is preparation. A practice with a written plan, a named response team and a rehearsed recovery process will meet a 30 day deadline. One that improvises will struggle. That rehearsal should include your IT provider, because the first hours of a breach are spent pulling logs and isolating devices. Practices that want help with that side can look at our HIPAA compliance services.
GlobeVM has supported businesses from Los Angeles, CA since 1996, first as Boby Systems and as GlobeVM since 2004. We sign a business associate agreement when a client needs one, respond within 15 minutes around the clock, and every client plan includes firewall management, endpoint protection, email filtering and MFA. For medical practices, our healthcare IT support covers both the federal rule and California's tighter deadlines.
Dental practices have their own mix of imaging systems, practice software and patient records, and our dental IT support page covers how we support them.
Key sources for this guide are the HHS Breach Notification Rule summary, the regulation text at 45 CFR Part 164, Subpart D, and California's Civil Code 1798.82. If you want to know whether your practice could meet a 30 day deadline before a breach tests it, call GlobeVM at (818) 405-9930 and ask for a breach readiness review.