HIPAA Breach Notification Rules: A Technical Guide to What Triggers Reporting and How Fast You Need to Move

Your monitoring system fires an alert at 2 AM: unauthorized access to a database containing patient records. The next 72 hours will determine whether this becomes a manageable incident or a compliance catastrophe.

HIPAA's Breach Notification Rule has specific requirements for what constitutes a breach, who must be notified, and how quickly. For technical teams, understanding these rules before an incident happens is the difference between a coordinated response and panic.

What Counts as a Breach

Under HIPAA (45 CFR 164.400-414), a breach is any unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises the security or privacy of the information.

The key word is unsecured. If the compromised data was encrypted to NIST standards and the encryption key was not compromised, it is not a reportable breach. This is the single most important technical control you can implement — it transforms a breach into a security incident.

The Four-Factor Risk Assessment

When an incident occurs, you must evaluate whether it constitutes a breach using four factors:

1. The nature and extent of PHI involved — Types of identifiers, clinical information, financial data
2. The unauthorized person who used or received the PHI — A curious employee vs. an external attacker carry different risk profiles
3. Whether PHI was actually acquired or viewed — Access logs showing the data was accessed vs. a misconfigured server that was exposed but never accessed
4. The extent of risk mitigation — Did you get a signed attestation of destruction? Did the unauthorized recipient confirm they did not retain copies?

If your assessment concludes low probability that PHI was compromised, you can document that finding and not report. But that assessment needs to be thorough and defensible — OCR will second-guess it if they review the incident later.

Notification Timelines

Once you determine a breach has occurred, the clocks start:

For Covered Entities

• Individual notification — Within 60 days of discovering the breach. Written notice to every affected individual via first-class mail (or email if they have consented to electronic communication).
• Media notification — If a breach affects 500+ residents of a single state or jurisdiction, you must notify prominent media outlets in that area within 60 days.
• HHS notification — Breaches affecting 500+ individuals must be reported to the Department of Health and Human Services within 60 days. Breaches affecting fewer than 500 individuals can be reported annually (within 60 days of the end of the calendar year).

For Business Associates

• Report to covered entity — Within 60 days of discovery (though many BAAs negotiate shorter windows — 10 to 30 days is common).
• Discovery is broadly defined — A breach is considered discovered when any person (not just leadership) within your organization knows or should reasonably have known about it. Your SOC analyst finding evidence at 2 AM starts the clock, not the meeting where they brief the CISO.

What the Notification Must Contain

Individual breach notifications must include:

• Description of the breach, including dates
• Types of PHI involved (names, SSNs, diagnosis codes, etc.)
• Steps individuals should take to protect themselves
• What you are doing to investigate and mitigate
• Contact information for questions

The Technical Decisions That Matter

1. Encryption as a Safe Harbor

If ePHI is encrypted consistent with NIST Special Publication 800-111 (data at rest) or NIST SP 800-52 (data in transit), and the encryption key was not compromised alongside the data, the data is considered secured and the incident is not a reportable breach.

This makes encryption the single highest-ROI security investment for healthcare organizations. A stolen encrypted laptop is a security incident. A stolen unencrypted laptop with patient data is a reportable breach potentially affecting thousands of individuals.

2. Logging Infrastructure

You cannot perform the four-factor risk assessment without comprehensive logs:

• Access logs — Who accessed the compromised system and when
• Data access logs — Which specific records were viewed, exported, or modified
• Network logs — What data left your network and where it went
• Authentication logs — How the unauthorized access was achieved

Without this data, you cannot determine the scope of the incident, which means you may need to assume worst-case and notify everyone whose data was in the compromised system.

3. Incident Response Automation

When the clock is ticking, manual processes fail. Your incident response should include:

• Automated containment — Revoke sessions, isolate affected systems, block suspicious IPs
• Automated evidence preservation — Snapshot affected systems, preserve logs, capture memory dumps
• Pre-built notification templates — Have individual notification letters, media statements, and HHS reporting forms ready to customize
• Communication playbooks — Who contacts legal, who contacts the covered entity (if you are a BA), who manages the technical response

4. Forensic Readiness

Post-breach investigation is dramatically easier if you have prepared:

• Immutable audit logs (cannot be tampered with by an attacker covering their tracks)
• Centralized log aggregation (do not rely on logs stored on compromised systems)
• Baseline network traffic patterns (so you can identify anomalous data exfiltration)
• Data flow documentation (knowing where PHI lives helps scope the incident)

Real Cost of Non-Compliance

HIPAA breach notification failures carry separate penalties from the underlying security failures:

• Failure to notify affected individuals — Up to 2.1 million dollars per violation category per year
• Failure to notify HHS — Additional penalties on top of breach penalties
• State attorney general actions — Many states have parallel notification requirements with their own penalties
• OCR investigations — A reported breach triggers an OCR investigation that examines your entire compliance program, not just the breach itself

The Breach Notification Rule is also why your Security Risk Analysis matters so much. If OCR investigates a breach and finds you never conducted an SRA, the penalties multiply. The SRA should have identified the vulnerabilities that led to the breach, and the remediation plan should have addressed them.

For organizations building or improving their incident response capabilities, understanding how breach notification connects to your broader compliance program is critical: HIPAA Compliance Solutions

And the foundation that makes breach response defensible — a thorough, documented risk analysis: HIPAA Risk Analysis Tools

---

Joe Gellatly is CEO of Medcurity, a HIPAA compliance platform that helps healthcare organizations manage risk assessments, compliance programs, and incident documentation.