HIPAA Breach Notification Guide
Posted: March 14, 2026 to Cybersecurity.
Key Takeaways
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, the Secretary of HHS, and in some cases, the media, in the event of a breach involving unsecured protected health information (PHI). The rule applies to breaches affecting 500 or more individuals, with notifications due within 60 days of discovery. Covered entities must also maintain a record of all breaches, regardless of size.
Introduction to HIPAA Breach Notification
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that sets national standards for protecting the confidentiality, integrity, and availability of protected health information (PHI). The HIPAA Breach Notification Rule, which became effective on September 23, 2009, requires covered entities to notify affected individuals, the Secretary of the Department of Health and Human Services (HHS), and in some cases, the media, in the event of a breach involving unsecured PHI. As a leading cybersecurity and AI company based in Raleigh, NC, Petronella Technology Group (PTG) has expertise in helping organizations navigate the complexities of HIPAA compliance.
HIPAA Breach Notification Requirements
The HIPAA Breach Notification Rule applies to breaches affecting 500 or more individuals. In such cases, covered entities must provide notification to affected individuals, the Secretary of HHS, and the media within 60 days of discovering the breach. The notifications must include specific information, such as a description of what happened, the types of PHI involved, and steps the individual can take to protect themselves from potential harm.
For breaches affecting fewer than 500 individuals, covered entities must maintain a record of all breaches, regardless of size, and provide notification to the Secretary of HHS within 60 days of the end of the calendar year in which the breach was discovered. Covered entities must also notify affected individuals within 60 days of discovering the breach.
PTG's team of experts, certified in CMMC, HIPAA, and SOC 2, can help organizations develop and implement effective breach notification policies and procedures to ensure compliance with the HIPAA Breach Notification Rule.
Breach Notification Timeline
The following timeline outlines the key milestones for breach notification under the HIPAA Breach Notification Rule:
- Discovery of the breach: Covered entities must discover the breach and begin the notification process within 60 days.
- Notification to affected individuals: Covered entities must provide notification to affected individuals within 60 days of discovering the breach.
- Notification to the Secretary of HHS: Covered entities must provide notification to the Secretary of HHS within 60 days of discovering the breach for breaches affecting 500 or more individuals, and within 60 days of the end of the calendar year in which the breach was discovered for breaches affecting fewer than 500 individuals.
- Notification to the media: Covered entities must provide notification to the media if the breach affects more than 500 residents of a state or jurisdiction.
Elements of a HIPAA Breach Notification
A HIPAA breach notification must include the following elements:
- A description of what happened, including the date of the breach and the date of discovery.
- A description of the types of PHI involved in the breach.
- A description of what the covered entity is doing to investigate the breach, protect against future breaches, and mitigate any harm caused by the breach.
- A statement that the individual can obtain a copy of the notice by contacting the covered entity.
PTG's team of experts can help organizations develop effective breach notification templates that meet the requirements of the HIPAA Breach Notification Rule. Visit petronellatech.com/training/ to learn more about our training programs.
Comparison of HIPAA Breach Notification Requirements and Other Regulations
The following table compares the HIPAA Breach Notification requirements with other relevant regulations:
| Regulation | Breach Threshold | Notification Timeline | Elements of Notification |
|---|---|---|---|
| HIPAA Breach Notification Rule | 500 or more individuals | 60 days from discovery | Description of breach, types of PHI involved, steps to investigate and mitigate harm |
| Gramm-Leach-Bliley Act (GLBA) | No specific threshold | As soon as possible | Description of breach, types of personal information involved, steps to protect against future breaches |
| Payment Card Industry Data Security Standard (PCI DSS) | No specific threshold | As soon as possible | Description of breach, types of cardholder data involved, steps to investigate and mitigate harm |
HIPAA Breach Notification Penalties and Fines
The HHS Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Breach Notification Rule. Covered entities that fail to comply with the rule may be subject to penalties and fines, which can range from $100 to $50,000 per violation, up to a maximum of $1.5 million per year.
PTG's team of experts, certified in CMMC, HIPAA, and SOC 2, can help organizations develop effective compliance programs to minimize the risk of penalties and fines. Call 919-348-4912 or visit petronellatech.com/training/ to learn more about our compliance services.
Best Practices for HIPAA Breach Notification Compliance
The following best practices can help organizations comply with the HIPAA Breach Notification Rule:
- Develop and implement effective breach notification policies and procedures.
- Conduct regular risk assessments to identify potential vulnerabilities.
- Provide training to employees on breach notification requirements and procedures.
- Regularly review and update breach notification policies and procedures to ensure compliance with changing regulations.
PTG's team of experts can help organizations develop effective breach notification policies and procedures, as well as provide training and risk assessments to ensure compliance with the HIPAA Breach Notification Rule. Visit petronellatech.com/ai/ to learn more about our AI-powered compliance solutions.
Frequently Asked Questions (FAQs) About HIPAA Breach Notification
The following FAQs provide additional information on the HIPAA Breach Notification Rule:
- Q: What is the purpose of the HIPAA Breach Notification Rule?
- Q: Who is subject to the HIPAA Breach Notification Rule?
- Q: What types of breaches are subject to the HIPAA Breach Notification Rule?
- Q: How do I report a breach under the HIPAA Breach Notification Rule?
- Q: What are the penalties for non-compliance with the HIPAA Breach Notification Rule?
A: The purpose of the rule is to require covered entities to notify affected individuals, the Secretary of HHS, and in some cases, the media, in the event of a breach involving unsecured PHI.
A: Covered entities, including healthcare providers, health plans, and healthcare clearinghouses, are subject to the rule.
A: Breaches involving unsecured PHI, including electronic PHI (ePHI) and paper-based PHI, are subject to the rule.
A: Covered entities must provide notification to affected individuals, the Secretary of HHS, and in some cases, the media, within 60 days of discovering the breach. The notifications must include specific information, such as a description of what happened, the types of PHI involved, and steps the individual can take to protect themselves from potential harm.
A: Covered entities that fail to comply with the rule may be subject to penalties and fines, which can range from $100 to $50,000 per violation, up to a maximum of $1.5 million per year.
Conclusion
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, the Secretary of HHS, and in some cases, the media, in the event of a breach involving unsecured PHI. Covered entities must develop and implement effective breach notification policies and procedures to ensure compliance with the rule. PTG's team of experts, certified in CMMC, HIPAA, and SOC 2, can help organizations navigate the complexities of HIPAA compliance. Call 919-348-4912 or visit petronellatech.com/training/ to learn more about our compliance services and training programs.
At PTG, we are committed to helping organizations protect sensitive information and maintain compliance with relevant regulations. Our team of experts is dedicated to providing effective solutions and guidance on HIPAA breach notification and other cybersecurity topics. Visit petronellatech.com/ai/ to learn more about our AI-powered compliance solutions.
