HIPAA breach notification deadlines

The covered entity is the group health plan, not the employer. A self-insured medical, dental, vision, health FSA, or HRA plan is a covered entity on its own; a fully insured plan is one too, with light obligations if the sponsor sees only summary health information and enrollment data. The plan has no staff, so the sponsor's HR and finance people who touch claims, appeals, or eligibility files are its workforce, and the TPA, PBM, stop-loss intermediary, and any benefits platform that sees claims are its business associates.

The Form 5500 shows whether a plan is self-insured and how many people are enrolled, which is the count that decides the notification track. Any plan's funding arrangement is on the employer index.

Under 45 CFR 164.402, a breach is an acquisition, access, use, or disclosure of unsecured protected health information that the Privacy Rule does not permit and that compromises the security or privacy of the PHI. “Unsecured” means not encrypted or destroyed to the standard in HHS guidance; a lost laptop with full-disk encryption and an unexposed key is not a breach.

An impermissible use or disclosure is presumed to be a breach unless the plan documents a low probability of compromise after a four-factor risk assessment:

1. the nature and extent of the PHI, including identifiers and the likelihood of re-identification;
2. the unauthorized person who used it or to whom it was disclosed;
3. whether the PHI was actually acquired or viewed; and
4. the extent to which the risk has been mitigated.

Three narrow exceptions exist: unintentional good-faith access by a workforce member within their authority; inadvertent disclosure between two people authorized to access PHI at the same entity; and a disclosure the recipient could not reasonably have retained. Under §164.414 the plan carries the burden of proving either that no breach occurred or that every notice was given.

A breach is “discovered” on the first day it is known, or by reasonable diligence would have been known, to any workforce member or agent of the plan. A TPA acting as the plan's agent can start the plan's clock on the day the TPA learns of it. For 10 or more unreachable individuals, substitute notice is a conspicuous website posting or major media notice plus a toll-free number, each kept up for 90 days.

Section 164.404(c) requires five elements, in plain language, by first-class mail (or email if the individual agreed to electronic notice):

• a brief description of what happened, including the date of the breach and the date of discovery, if known;
• the types of unsecured PHI involved (name, Social Security number, date of birth, diagnosis, claims data, and so on);
• steps individuals should take to protect themselves;
• what the plan is doing to investigate, mitigate harm, and prevent recurrence; and
• contact procedures: a toll-free number, email address, website, or postal address.

Business associates owe the covered entity the identity of each affected individual and whatever else the plan needs to write its notices. Keep every notice, the risk assessment, the mailing list, and the HHS submission receipt for six years (§164.530(j)), the retention period for all HIPAA compliance records.

Yes, as of October 2026. OCR published a proposed rule on January 6, 2025 that would make every Security Rule specification required (no more “addressable”), mandate encryption at rest and in transit, multifactor authentication, a written asset inventory and network map, annual compliance audits, 72-hour restoration of critical systems, and annual written verification of business associate safeguards. Comments closed March 7, 2025; OCR received more than 4,700.

The Spring 2026 Unified Agenda, released in July 2026, moved the final rule from a May 2026 target to a July 2027 long-term action. Agenda dates are not binding; the rule could be finalized, narrowed, or withdrawn. Until then the 2013 Security Rule is the standard, and its risk-analysis requirement is where penalties are being assessed now.

The regulatory deadline is 60 days, but the first three days decide whether the notice is accurate, whether evidence survives, and whether “without unreasonable delay” can be defended.

1. Hour 0–4: contain and record the discovery date. Isolate the system or account, preserve logs, and write down who learned what, when. That date starts the 60-day clock.
2. Hour 4–24: name the privacy official and counsel. Every plan must have a designated privacy official; if nobody can say who it is, that is OCR's first finding. Engage counsel so the forensic work is privileged.
3. Day 1: notify the cyber insurer and the business associates in the chain. Most policies require prompt notice. Pull the BAAs and check each one's notice period.
4. Day 1–2: scope the data. Which data elements, how many individuals, which states. State counts drive media notice and the state breach laws that run on their own clocks (several are 30 or 45 days).
5. Day 2–3: run and document the four-factor risk assessment. A “no breach” conclusion stands only on the written assessment.
6. Day 3: set the notification plan. Draft the individual notice, decide on credit monitoring, line up a call center if the count is large, and calendar the 60-day outer date and the HHS portal submission.

• Confirm which plans are self-insured and therefore carry the full covered-entity obligation set; the Form 5500 funding fields settle it.
• Locate the plan's last enterprise-wide risk analysis. If it is over a year old or does not exist, that is the gap OCR has been fining since 2024.
• Pull every business associate agreement and list the breach-notice period in each one; renegotiate any that still say 60 days.
• Write the 72-hour sequence above into the plan's incident response procedure with names, not titles, and test it once a year.
• Set a recurring reminder for the under-500 annual log submission to HHS, due within 60 days of each calendar year end.