HHS HIPAA Breach Portal: How to File a Breach Notification

If you must report a HIPAA breach to HHS, the filing is submitted through the OCR Breach Portal at ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf. Breaches affecting 500 or more individuals must be filed contemporaneously with the individual notice and within 60 days of discovery. Breaches affecting fewer than 500 are filed annually, no later than 60 days after the end of the calendar year of discovery, under 45 CFR § 164.408(c).

When the Portal is required

The breach-reporting obligation lives at 45 CFR § 164.408 and applies whenever the four-factor risk assessment under 45 CFR § 164.402 does not document a low probability of compromise. Two paths:

• 500 or more individuals affected. Report through the Portal contemporaneously with the individual notice — no later than 60 calendar days from the date of discovery. The submission appears within days on the OCR public breach list at ocrportal.hhs.gov/ocr/breach/breach_report.jsf, commonly called the "Wall of Shame." Media notice under 45 CFR § 164.406 is also required for 500+ residents of any single state or jurisdiction.
• Fewer than 500 individuals affected. Log the breach and submit the annual report through the Portal no later than 60 days after the end of the calendar year in which the discovery occurred. Each qualifying incident is a separate submission — the Portal does not bundle multiple incidents into one report.

Discovery is defined at 45 CFR § 164.404(a)(2) as the first day on which the breach is known, or by exercising reasonable diligence would have been known, by any workforce member or agent of the covered entity. Workforce knowledge is imputed to the entity.

What you'll need before filing

The Breach Portal form requires more granular numbers than most practices can produce in 60 days without prep. Assemble before you open the wizard:

• Covered entity name and address exactly as registered with HHS, including NPI and tax ID
• Contact person for OCR follow-up — typically the Privacy Officer or outside counsel
• Business associate information, if the breach occurred at or involved a BA, including BA name and contact
• Date of breach (or date range), distinct from the date of discovery
• Date of discovery — the date documented in your discovery memo per Step 1 of the 60-day window guide
• Approximate number of individuals affected — best estimate at filing; amend if the final number changes materially
• Type of breach — selected from the Portal taxonomy: hacking/IT incident, unauthorized access/disclosure, theft, loss, improper disposal, other
• Location of breached information — laptop, desktop, network server, email, paper, electronic medical record, other portable electronic device, other
• Type of PHI involved — clinical, demographic, financial, other
• Brief description of breach — narrative field; OCR uses this as the public-facing summary
• Safeguards in place before the breach — administrative, physical, technical
• Actions taken in response — notification, mitigation, sanctions, training, additional safeguards, policies and procedures updated, other
• Whether law enforcement was notified and any law-enforcement delay request under 45 CFR § 164.412

Counsel should review every narrative field before submission. The "Brief description" and "Actions taken" fields are the most visible to OCR investigators and to the public.

Walking through the form

The Portal wizard is a multi-step web form. The flow:

1. Submitter information. Name, title, organization, contact email and phone. This is the person OCR calls — typically the Privacy Officer or outside counsel. The submitter is not the covered entity; the covered entity is identified separately.
2. Covered entity information. Legal name, address, type (provider, health plan, healthcare clearinghouse), and contact. If the breach affected the covered entity but was caused at a business associate, the BA is identified in a separate section.
3. Breach information. Dates of breach and discovery, approximate count of affected individuals, type of breach (drop-down), location of breached information (drop-down with multi-select), type of PHI (drop-down with multi-select). Required.
4. Brief description. A free-text narrative. Keep it factual, neutral, and consistent with the individual notice content. Do not editorialize and do not minimize. OCR uses this on the public list verbatim.
5. Safeguards in place before the breach. Multi-select with administrative, physical, and technical safeguard categories. Be honest — overclaiming here creates a credibility problem with OCR investigators who will request evidence.
6. Actions taken in response. Multi-select: individual notice, HHS notice, media notice, law enforcement notification, mitigation, sanctions, training, additional safeguards, policies updated, business associate agreement updated, other. Tracks to the corrective action plan OCR will eventually request.
7. Review and submit. The wizard generates a confirmation page with a tracking number. Save it. The number is required to amend the report later.

For 500+ breaches, the submission posts to the public OCR breach list within days. Under-500 breaches are submitted through the same Portal but are not publicly listed; the public list at ocrportal.hhs.gov/ocr/breach/breach_report.jsf is limited to HIPAA breaches affecting 500 or more individuals.

After you file

OCR opens an investigation on most 500+ Portal submissions. Smaller breaches sometimes draw investigations as well, particularly when they exhibit patterns OCR has flagged in recent Resolution Agreements (right-of-access failures, encryption gaps, BAA gaps, untrained workforce).

Expect within the following 30 to 90 days:

• An acknowledgment letter from the OCR Regional Office assigning a docket number and a lead investigator
• A request for documentation — Security Risk Analysis, policies and procedures, BAAs, training records, the four-factor analysis, the individual notice and mailing log, the law-enforcement delay request (if any), and the corrective actions taken
• A follow-up data request narrowing in on specific controls, often the addressable specifications under 45 CFR § 164.306(d)(3)
• A potential request for an interview with the Security or Privacy Officer

The Portal submission does not end the matter. It begins it. The guide on responding to an OCR investigation letter covers the response posture.

Common filing mistakes

Practices that confuse a single submission with a complete compliance act commonly stumble in five places:

1. Filing without counsel review. The narrative is the most consequential document OCR will read about the breach. Counsel should draft or review every word.
2. Inconsistent counts across the individual notice, the Portal, and state filings. OCR's first follow-up question is usually "why does your Portal filing say 542 and your individual mailing log say 537?" Reconcile before submission.
3. Overclaiming safeguards. Marking "encryption at rest" when only the laptop was encrypted (not the affected server) is an evidence problem the moment OCR requests documentation.
4. Filing the under-500 report late. The March 1 deadline (for prior-year discoveries) is missed routinely. Late annual filings are themselves violations under 45 CFR § 164.408(c).
5. Forgetting state breach paths. The Portal is a federal filing only. CA, TX, NY, MA, FL, IL, and most other states require parallel notification to the state AG or other authority, often on shorter timelines.

A sixth, easy-to-miss issue: practices file the report but never document internally why filing was required (or why a particular four-factor analysis did not support a "low probability" finding). OCR routinely asks for the internal analysis after seeing the Portal submission.

State-law overlay

State breach laws frequently impose shorter clocks and additional content requirements:

• California (Civil Code § 1798.82; CMIA § 56.36) — notice to affected California residents and to the California Attorney General when 500+ California residents are affected. Licensed clinics also have a 15-business-day notice path to the California Department of Public Health.
• Texas (Business and Commerce Code § 521.053; HB 300) — 60-day notice with notification to the Texas Attorney General when 250+ Texas residents are affected.
• New York (General Business Law § 899-aa, SHIELD Act) — notification to affected individuals without unreasonable delay, plus parallel notice to the New York Attorney General, Department of State, and State Police.
• Massachusetts (G.L. c. 93H) — notice to affected residents, the Attorney General, and the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay.
• Florida (F.S. § 501.171, FIPA) — notification to affected individuals within 30 days of determination of a breach and to the Department of Legal Affairs if 500+ Florida residents are affected.

The HHS Portal does not relieve the practice of any state filing.

What not to touch

• Do not let the 60-day clock slip waiting for forensics. File on best information available and amend; missing the federal deadline is itself a violation.
• Do not paraphrase the individual notice differently in the Portal. Inconsistencies appear in OCR follow-up exhibits.
• Do not delete or rework the discovery memo, the four-factor analysis, or any pre-filing email. Litigation hold runs from discovery.
• Do not allow workforce members to discuss the breach publicly before the Portal submission and individual notice have gone out.
• Do not use the Portal narrative to argue your defense. Keep it neutral and factual. Defense belongs in the document response to the OCR letter.

How d3rx fits

The d3rx compliance binder maintains the breach response workflow that feeds the Portal filing: discovery memo, four-factor analysis, individual notification mailing log, HHS Portal submission record (tracking number, date, counts, narrative), media notice tracker, and the under-500 annual filing log. The d3rx audit defense workflow walks the first 48 hours after Portal submission, the OCR follow-up data request structure, and the tab-by-tab response. d3rx does not submit Portal filings on behalf of the practice and does not represent the practice before OCR. It is a source-grounded administrative documentation aid that counsel and the practice work from.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.