Quick Answer: When a breach of unsecured PHI occurs, HIPAA requires notification to affected individuals within 60 days, reporting to HHS (immediately for breaches affecting 500+ individuals, or annually for smaller breaches), and notification to media outlets for breaches affecting 500+ individuals in a single state. The 2026 Security Rule update adds a 72-hour notification requirement to HHS for certain security incidents.
What Constitutes a HIPAA Breach?
A breach is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI. There is a presumption that any impermissible use or disclosure is a breach unless your organization can demonstrate a low probability that the PHI was compromised through a four-factor risk assessment.
The Breach Notification Timeline
HIPAA’s breach notification requirements operate on strict timelines. Individual notification must occur without unreasonable delay and no later than 60 calendar days after discovery of the breach. HHS notification for breaches affecting 500 or more individuals must occur within 60 days — and under the 2026 Security Rule update, certain security incidents require notification to HHS within 72 hours. HHS notification for smaller breaches (fewer than 500 individuals) must occur within 60 days after the end of the calendar year in which the breach was discovered. Media notification is required for breaches affecting 500 or more residents of a single state or jurisdiction, also within 60 days.
Step-by-Step Breach Response Process
When a potential breach is identified, follow these steps. First, contain the breach immediately — stop any ongoing unauthorized access and secure affected systems. Second, investigate the scope — determine what PHI was involved, how many individuals are affected, and whether the data was actually accessed or acquired. Third, conduct the four-factor risk assessment to determine if notification is required. Fourth, document everything from the moment of discovery through resolution. Fifth, notify affected individuals with specific required content. Sixth, report to HHS through the breach notification portal. Seventh, implement corrective actions to prevent recurrence.
What Individual Notification Must Include
Breach notification letters to affected individuals must include a description of the breach including dates, the types of PHI involved, steps individuals should take to protect themselves, what your organization is doing to investigate and mitigate harm, and contact information for questions. Notification must be sent by first-class mail or email (if the individual has previously agreed to electronic notification).
The 72-Hour Notification Rule (2026)
The 2026 Security Rule update introduces a new 72-hour notification requirement for certain security incidents. This is significantly faster than the existing 60-day timeline and brings HIPAA closer to the notification standards in other frameworks. Organizations must have incident detection capabilities that can identify breaches quickly enough to meet this compressed timeline.
Penalties for Late or Missing Notification
Failing to provide timely breach notification is itself a HIPAA violation — separate from the underlying breach. Penalties for notification failures can compound on top of penalties for the breach itself. Understanding the full cost of non-compliance reinforces why having a documented, tested breach response plan is essential.
Building Your Breach Response Plan
Every healthcare organization needs a documented breach response plan that all staff understand. The plan should designate a breach response team with clear roles, establish communication channels for reporting suspected breaches, define investigation procedures, include notification letter templates, document the HHS reporting process, and establish relationships with legal counsel and forensic investigators. Include breach response in your workforce training program so staff know how to recognize and report potential breaches.
Frequently Asked Questions
How quickly must I report a HIPAA breach?
Individual notification must occur within 60 days of discovering the breach. HHS notification for large breaches (500+ individuals) must also occur within 60 days. The 2026 Security Rule adds a 72-hour notification requirement for certain security incidents.
Do I have to report every HIPAA breach to HHS?
Yes, all breaches of unsecured PHI must be reported to HHS. Breaches affecting 500+ individuals must be reported within 60 days. Smaller breaches are reported annually.
What is the HIPAA breach penalty?
Breach-related penalties depend on the nature and extent of the violation and can range from $141 to over $2 million per violation. The failure to notify is an additional violation with its own penalties.