Business Associate Breach Notification (45 CFR 164.410)
Business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days from discovery, with required content for the covered entity's downstream notifications.
Primary source
45 CFR 164.410 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.410
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.410 requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. Discovery is again the first day known or — by reasonable diligence — should have been known.
The notification must include, to the extent possible: identification of each individual whose PHI was, or is reasonably believed to have been, breached; and any other available information the covered entity needs to fulfill its notification obligations under 164.404 (description of what happened, types of PHI, mitigation steps).
The business associate's 60-day clock runs independent of any internal investigation timeline. Many BAAs negotiate the BA's reporting deadline tighter than 60 days — 24, 48, or 72 hours is common — so the covered entity has runway to assess and notify within its own 60-day clock.
The 2024 Change Healthcare ransomware event made clear how cascading BA breaches operate at scale: a single BA event triggered thousands of downstream covered-entity notifications. Tight BA contractual reporting timelines, vendor-incident playbooks, and pre-mapped vendor inventories are the practical defense.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Business Associate Agreements (45 CFR 164.504(e))Required contract elements for any business associate that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- RegulationHIPAA Individual Breach Notification (45 CFR 164.404)Required content, methods, and 60-day deadline for notifying affected individuals after a breach of unsecured PHI.
- RegulationHITECH Business Associate Direct Liability (45 CFR 160.103, 164.502(a)(3))Business associates are directly liable for Security Rule compliance, breach notification, certain Privacy Rule provisions, and BAA flow-down to subcontractors.
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
- SRAThe HIPAA Breach Notification Rule, ExplainedThe four-factor risk assessment at 45 CFR 164.402, the 60-day individual notice clock at 164.404, the HHS/media notice paths, and the small-practice annual report under 164.408(c).
- ComplianceBusiness Associate Agreement Template (2026) + Counterparty TrackerA 2026 HIPAA Business Associate Agreement template with every 45 CFR 164.504(e) required clause, plus the vendor tracker auditors expect alongside it.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.