HIPAA HHS and Media Breach Notification (45 CFR 164.406-408)
Notification timing and content for HHS (annual for smaller breaches, 60 days for 500+) and the prominent media (500+ in a state or jurisdiction).
Primary source
45 CFR 164.406-408 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
The Breach Notification Rule sets two notification tracks beyond the individual notice required by 164.404.
HHS notification (164.408): required for every breach. For breaches affecting 500 or more individuals, notify HHS contemporaneously with the individual notification (no later than 60 days from discovery). For breaches affecting fewer than 500 individuals, log them and submit annually to HHS within 60 days after the end of the calendar year. The mechanism is the HHS OCR Breach Portal.
Media notification (164.406): required only when a breach affects more than 500 residents of a state or jurisdiction. Notify prominent media outlets serving that state or jurisdiction in the form of a press release, no later than 60 days from discovery. Content mirrors the individual notice.
The 500-individual threshold places the breach on the public-facing OCR breach portal ("Wall of Shame") and almost always triggers OCR investigation. Reporting accuracy matters: misclassifying a 500+ breach as smaller, or delaying the report to push it past a fiscal-year boundary, is itself a citable Breach Notification Rule violation and has aggravated past settlements.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Breach Notification Rule Overview (45 CFR 164.400-414)When unsecured PHI is accessed, used, or disclosed in a manner not permitted, the entity must follow individual, HHS, and (in some cases) media notification requirements within defined timelines.
- RegulationBusiness Associate Breach Notification (45 CFR 164.410)Business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days from discovery, with required content for the covered entity's downstream notifications.
- RegulationHIPAA Individual Breach Notification (45 CFR 164.404)Required content, methods, and 60-day deadline for notifying affected individuals after a breach of unsecured PHI.
- GlossaryHIPAA Breach Notification RuleThe federal rule at 45 CFR Part 164 Subpart D requiring covered entities and business associates to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI.
- ComplianceHHS HIPAA Breach Portal: How to File a Breach NotificationFiling through ocrportal.hhs.gov is the single most-visible compliance act a practice ever performs. Here is the form, the numbers, and the choices that drive the OCR response.
- SRAThe HIPAA Breach Notification Rule, ExplainedThe four-factor risk assessment at 45 CFR 164.402, the 60-day individual notice clock at 164.404, the HHS/media notice paths, and the small-practice annual report under 164.408(c).
- ComplianceBehavioral Health Compliance: 42 CFR Part 2 + HIPAA TogetherHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.