HIPAA Breach Notification: The 60-Day Window Step-by-Step

If you discovered a HIPAA breach, you have 60 calendar days from the date of discovery to notify affected individuals, the HHS Secretary, and in some cases prominent media outlets under 45 CFR §§ 164.404–164.408. The deadline is firm. Missing it drives Resolution Agreements with multi-year corrective action plans.

Step 1: Confirm the date of discovery

Discovery starts the clock and is the most-litigated date in any breach matter. 45 CFR § 164.404(a)(2)(2)) defines discovery as the first day on which the breach is known, or by exercising reasonable diligence would have been known, by any workforce member or agent of the covered entity — except the person who committed the breach.

Workforce knowledge is imputed to the entity. A front-desk employee who notices a misdirected fax on a Friday and reports it Monday established discovery on Friday, not Monday. A vendor's alert to your help desk establishes discovery the moment your help desk received it.

Document the discovery date in a memo to file the day discovery occurs. Include source of the report, time, recipient, and the initial scope description. This document determines every downstream deadline.

Step 2: Run the four-factor risk assessment

Under 45 CFR § 164.402, an acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule is presumed to be a breach unless the covered entity demonstrates a low probability that the PHI has been compromised. The four factors:

1. Nature and extent of the PHI involved, including identifiers (name, SSN, DOB, MRN, diagnosis, financial information) and the likelihood of re-identification.
2. The unauthorized person who used the PHI or to whom the disclosure was made. A misdirected fax to another covered entity is different from a disclosure to the open internet.
3. Whether the PHI was actually acquired or viewed, versus merely accessible. Forensic logs matter here.
4. The extent to which the risk has been mitigated, including written assurances of destruction or non-use.

The analysis must be documented and retained for six years under 45 CFR § 164.530(j)). A documented "low probability" finding means no notification — but the documentation itself is the practice's defense if OCR later disagrees.

Step 3: Check the encryption safe harbor

If the affected PHI was encrypted to NIST standards under the HHS Guidance to Render Unsecured PHI Unusable, it is not "unsecured PHI" under 45 CFR § 164.402 and the Breach Notification Rule does not apply. This is the single highest-leverage control. Document encryption status of the affected data at the time of the incident.

The exclusions at 45 CFR § 164.402(1) are narrow: unintentional access by workforce in good faith, inadvertent disclosure between authorized people at the same entity, and disclosures the recipient could not reasonably retain. Document the conclusion when claimed; OCR scrutinizes the exclusions tightly.

Step 4: Build the individual notice

If notification is required, the notice to affected individuals must go out without unreasonable delay and no later than 60 calendar days from discovery under 45 CFR § 164.404(b)). Required content under 45 CFR § 164.404(c)):

• A brief description of what happened, including the date of breach and date of discovery
• A description of the types of unsecured PHI involved (name, SSN, diagnosis, etc.) — not the specific data
• Steps individuals should take to protect themselves
• A brief description of what the covered entity is doing to investigate, mitigate harm, and prevent recurrence
• Contact procedures (toll-free number, email, website, or postal address)

Delivery is by first-class mail to the individual's last known address, or by email if the individual has agreed to electronic notice. For 10 or more individuals with insufficient or out-of-date contact info, substitute notice under 45 CFR § 164.404(d)) applies: conspicuous posting on the home page of the covered entity's website for 90 days, OR conspicuous notice in major print or broadcast media, plus a toll-free number active for at least 90 days.

Step 5: Notify the HHS Secretary

Two paths under 45 CFR § 164.408:

• 500 or more individuals affected: Submit to the HHS Breach Reporting Portal contemporaneously with the individual notice — no later than 60 days after discovery. The submission appears on the OCR public "Wall of Shame" at OCR Breach Portal.
• Fewer than 500 individuals affected: Log the incident and submit an annual report through the same portal no later than 60 days after the end of the calendar year in which discovery occurred.

Step 6: Media notice if 500+ in one state or jurisdiction

Under 45 CFR § 164.406, breaches affecting 500 or more residents of a single state or jurisdiction require notice to prominent media outlets serving that area, contemporaneously with the individual notice and within 60 days of discovery. The media notice content matches the individual notice content. A practice press release published on the website is not a substitute for actual media outreach to prominent outlets.

What NOT to touch

• Do not delete logs, emails, or backups referencing the incident. Litigation hold begins on discovery.
• Do not edit the affected records to "clean up" the chart. Forensic integrity matters.
• Do not negotiate ransom payments without counsel and FBI engagement. The HHS ransomware guidance is the agency's baseline position and treats ransomware on ePHI as a presumptive breach.
• Do not communicate publicly before the notice is finalized. Inconsistent statements appear in subpoena exhibits.
• Do not delay the four-factor analysis pending "more information." OCR has repeatedly cited delayed analyses as independent violations.

State-law overlay

State breach notification statutes can run faster than HIPAA and require parallel notification.

• California (CMIA, Civil Code § 56.36; CCPA breach notice) — broad definition of medical information, separate notification path to the California Attorney General when 500+ California residents affected.
• Texas (Business and Commerce Code § 521.053; HB 300) — individual notice no later than 60 days from determination of the breach under § 521.053(b); separately, when 250+ Texas residents are affected, notice to the Texas Attorney General is due as soon as practicable and no later than 30 days under § 521.053(i).
• New York (SHIELD Act, General Business Law § 899-aa) — notification required without unreasonable delay; notice to the New York Attorney General, Department of State, and State Police.
• Massachusetts (201 CMR 17.00; G.L. c. 93H) — strict notification timeline plus written information security program requirements.

Many states have shorter clocks than HIPAA's 60-day federal maximum. Map the affected population by state and check each state's separate notification path.

Documentation retained for six years

Under 45 CFR § 164.530(j)) and 45 CFR § 164.316(b)) the practice retains for at least six years:

• The discovery memo
• The four-factor analysis worksheet
• Encryption status of affected systems at time of incident
• The individual notification letter and mailing log
• The HHS portal submission confirmation
• The media notice (where applicable) and outlet list
• The law enforcement delay request (where applicable)
• The corrective action plan and evidence of completion

When to engage outside healthcare counsel

Engage immediately on any breach involving 500+ individuals, ransomware on ePHI, an insider threat or potentially terminated employee, payment-card data adjacent to PHI, or any incident with media exposure. Counsel coordinates the four-factor analysis under privilege, runs the notification process, and manages OCR if an investigation opens after the portal submission. OCR opens an investigation on most 500+ submissions.

How d3rx fits

d3rx maintains the breach response workflow inside the compliance binder: incident intake form, four-factor analysis worksheet, individual notification templates, HHS portal submission record, media notice tracker, and the under-500 annual report log. The binder is a source-grounded administrative aid. It does not represent the practice before OCR, does not provide legal advice, and does not replace counsel. See audit defense for broader response support and the compliance binder overview for binder structure.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.