What is the HIPAA breach notification timeline?

HIPAA breach notifications must be made without unreasonable delay and no later than 60 days after discovery. Business associates notify the covered entity; covered entities notify affected individuals, HHS, and in large breaches the media.

What is the HIPAA 4-factor risk assessment?

The 4-factor assessment looks at the nature and extent of PHI involved, who used or received it, whether the PHI was actually acquired or viewed, and how much the risk was mitigated.

When do I notify HHS after a HIPAA breach?

Breaches affecting 500 or more people require HHS notice without unreasonable delay and no later than 60 days after discovery. Smaller breaches are logged and reported to HHS no later than 60 days after the end of the calendar year.

When does a HIPAA breach require media notice?

If a breach affects more than 500 residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving that area, generally within the same 60-day outer deadline.

What should a HIPAA breach file include?

Keep the incident timeline, containment notes, affected systems and people, the 4-factor risk assessment, notification decisions, copies of notices, mitigation steps, and the final closure memo.

HIPAA breach response · operator checklist

HIPAA Breach Response Checklist: the 60-day clock and the 4-factor assessment

When PHI may have been exposed, the job is not to panic or guess. The job is to preserve facts, contain the incident, run the risk assessment, decide whether notification is required, and document the file as if OCR will read it later.

Fast answer: treat discovery as day zero. Contain and preserve logs immediately, run the HIPAA 4-factor risk assessment, notify covered entities or affected individuals without unreasonable delay, and never exceed the 60-day outer deadline when notification is required.

Hour 0-24Contain

Disable access, preserve logs, snapshot systems, stop additional PHI exposure.

Day 1-7Assess

Run the 4-factor risk assessment and scope affected people, data, and vendors.

Before day 60Notify

Individuals, HHS, covered entities, and media when thresholds require it.

CloseoutDocument

Keep the decision file, notices, mitigation, and the final operator memo.

The response checklist

Do first

Discovery and containment

Record when the incident was discovered and who discovered it.
Stop the exposure without destroying evidence.
Preserve logs, access records, messages, files, exports, and vendor tickets.
Identify whether PHI was involved, not just personal information generally.

Risk call

The HIPAA 4-factor risk assessment

Nature and extent of PHI involved.
Who used or received the PHI.
Whether PHI was actually acquired or viewed.
How much the risk was mitigated.

Clock

Notification thresholds

Notifications must happen without unreasonable delay and no later than 60 days after discovery when a breach is reportable. Breaches affecting 500 or more people trigger faster public visibility: individual notice, HHS notice, and media notice for the affected area. Smaller breaches still get logged and reported to HHS annually.

File

The documentation trail

Keep one incident file: timeline, evidence preserved, affected data, vendors involved, BAA chain, 4-factor assessment, notification decision, copies of notices, mitigation work, and final closure memo. The file is the proof that the response was rational.

Operator note: the 60-day deadline is not a planning window. It is the outer wall. The response should move as fast as the facts allow, because the penalty pattern is often not the breach itself; it is the delay, confusion, missing logs, and undocumented decision-making after discovery.

HIPAA Breach Response Checklist: the 60-day clock and the 4-factor assessment

The response checklist

Discovery and containment

The HIPAA 4-factor risk assessment

Notification thresholds

The documentation trail

Related HIPAA pages