HIPAA Individual Breach Notification (45 CFR 164.404)
Required content, methods, and 60-day deadline for notifying affected individuals after a breach of unsecured PHI.
Primary source
45 CFR 164.404 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.404 requires a covered entity to notify each individual whose unsecured PHI has been (or is reasonably believed to have been) accessed, acquired, used, or disclosed as a result of a breach.
Timing: without unreasonable delay and in no case later than 60 calendar days after discovery. A breach is treated as discovered on the first day it is known to the entity, or by exercising reasonable diligence would have been known. Workforce knowledge is imputed to the entity.
Content (164.404(c)): a brief description of what happened including dates; description of the types of unsecured PHI involved; steps the individual should take to protect themselves; what the entity is doing to investigate, mitigate harm, and protect against further breaches; and contact procedures (toll-free number, email, web address, or postal address).
Method: written notice by first-class mail to the individual's last known address (or email if the individual has agreed). Substitute notice (web posting plus media for an extended period) is required if contact information is insufficient or out-of-date for 10+ individuals.
Delays at the request of law enforcement are permitted under 164.412 with written documentation. The 60-day clock is hard.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
HIPAA Breach Notification Rule Overview (45 CFR 164.400-414)
OCR · HIPAA Breach Notification RuleHIPAA Breach Definition and Four-Factor Risk Assessment (45 CFR 164.402)
OCR · HIPAA Breach Notification RuleHIPAA HHS and Media Breach Notification (45 CFR 164.406-408)
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Breach Definition and Four-Factor Risk Assessment (45 CFR 164.402)Definition of breach and the four-factor low-probability-of-compromise assessment that determines whether a non-permitted use or disclosure triggers notification.
- RegulationHIPAA HHS and Media Breach Notification (45 CFR 164.406-408)Notification timing and content for HHS (annual for smaller breaches, 60 days for 500+) and the prominent media (500+ in a state or jurisdiction).
- RegulationHIPAA Breach Notification Rule Overview (45 CFR 164.400-414)When unsecured PHI is accessed, used, or disclosed in a manner not permitted, the entity must follow individual, HHS, and (in some cases) media notification requirements within defined timelines.
- SRAThe HIPAA Breach Notification Rule, ExplainedThe four-factor risk assessment at 45 CFR 164.402, the 60-day individual notice clock at 164.404, the HHS/media notice paths, and the small-practice annual report under 164.408(c).
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
- ComplianceCalifornia Healthcare Compliance: CMIA + HIPAA — Where They DivergeCalifornia's CMIA (Civ. Code §§ 56–56.37) vs HIPAA: stricter consent, 5-working-day inspection / 15-day copy access, private right of action, up to $25k per knowing-and-willful violation + misdemeanor exposure.
- GlossaryHIPAA Breach Notification RuleThe federal rule at 45 CFR Part 164 Subpart D requiring covered entities and business associates to notify affected individuals, HHS, and sometimes the media after a breach of unsecured PHI.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.