HIPAA Breach Notification Rule Explained for Healthcare Staff
What counts as a breach of unsecured PHI, how the four-factor risk assessment works, the 60-day notification deadlines and what healthcare staff should do when something goes wrong.
The HIPAA Breach Notification Rule requires healthcare providers, health plans and their business associates to tell affected patients, the US Department of Health and Human Services (HHS) and, for larger incidents, the media when unsecured protected health information (PHI) is breached. Notices to patients must go out without unreasonable delay and no later than 60 calendar days after the breach is discovered (HHS Office for Civil Rights, Breach Notification Rule guidance, 2013). For front-line staff, the key duty is simple: report anything that looks wrong, straight away, through your internal process.
This guide covers what counts as a breach, how the risk assessment works, which deadlines apply and where you fit in. For what HIPAA (the Health Insurance Portability and Accountability Act) says about staff training generally, see our guide to HIPAA training requirements.
What is a breach of unsecured PHI?
A breach is a use or disclosure of PHI that the HIPAA Privacy Rule does not permit and that compromises the privacy or security of the information. Any such use or disclosure is presumed to be a breach unless the organisation can show a low probability that the information was compromised (HHS Office for Civil Rights, 2013).
"Unsecured" matters. The notification duties apply only to PHI that has not been made unusable, unreadable or indecipherable to unauthorised people using methods HHS specifies, namely encryption or destruction. If a properly encrypted laptop goes missing, notification may not be needed.
Everyday incidents that may be breaches include:
- Emailing a patient's results to the wrong person
- Looking up a neighbour's record out of curiosity
- Losing an unencrypted phone or USB stick holding patient details
- A cyber attack, such as ransomware, that exposes patient systems
The three exceptions
HHS lists three situations that are not breaches: unintentional, good-faith access by a workforce member acting within their role; inadvertent disclosure between two people authorised to access PHI at the same organisation; and disclosure where the organisation believes in good faith the recipient could not reasonably have kept the information. Deciding whether an exception applies is your privacy officer's job, so report the incident either way.
The four-factor risk assessment
To rebut the presumption of a breach, the organisation must assess at least these four factors (HHS Office for Civil Rights, 2013):
- The nature and extent of the PHI, including the types of identifiers and how likely re-identification is.
- Who used or received it, for example another HIPAA-covered provider versus an unknown member of the public.
- Whether the PHI was actually acquired or viewed, or only could have been.
- How far the risk has been mitigated, such as written confirmation that a misdirected file was deleted.
Organisations may choose to notify without completing an assessment. Either way, they must be able to prove that every required notice was sent, or document why none was needed. That is why the details you give when reporting are so valuable.
Breach notification deadlines at a glance
The clock starts on discovery. A breach is treated as discovered on the first day it is known to the organisation, or would have been known with reasonable diligence, and knowledge held by any workforce member (other than the person who caused it) counts (45 CFR §164.404(a)(2)). The day you notice a problem can be day one.
| Who must be told | When it applies | Deadline |
|---|---|---|
| Affected individuals | Every breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery |
| Prominent media outlets | More than 500 residents of one state or jurisdiction affected | Without unreasonable delay, no later than 60 calendar days after discovery |
| HHS Secretary | 500 or more individuals affected | Without unreasonable delay, no later than 60 calendar days after discovery |
| HHS Secretary | Fewer than 500 individuals affected | Within 60 days of the end of the calendar year in which the breach was discovered |
| Covered entity, by its business associate | Breach at or by a business associate | Without unreasonable delay, no later than 60 calendar days after discovery |
Sources: HHS Office for Civil Rights Breach Notification Rule guidance (2013) and Submitting Notice of a Breach to the Secretary (HHS, 2026). Sixty days is an outer limit, not a target, and some states have their own breach laws too.
What a patient notice contains
Notices go by first-class mail, or by email if the patient has agreed to that. They explain what happened, what information was involved, steps patients can take to protect themselves, what the organisation is doing and how to get in touch. If contact details are out of date for 10 or more people, substitute notice is required: a website notice for 90 days or a notice in major print or broadcast media, plus a toll-free number active for at least 90 days (HHS, 2013).
Business associates
Business associates are outside firms that handle PHI for a provider, such as billing companies or cloud suppliers. When they discover a breach, they must notify the covered entity and identify affected individuals where possible. The covered entity stays responsible for notifying patients, though it can delegate the task (HHS, 2013).
How common are breaches?
For calendar year 2024, the HHS Office for Civil Rights received 663 reports of breaches affecting 500 or more people and 74,299 reports of smaller breaches (HHS Annual Report to Congress on Breaches of Unsecured PHI, 2024). Hacking and IT incidents caused most large breaches, while unauthorised access or disclosure made up most small ones. Those small incidents, like a misdirected letter, are exactly what front-line staff are best placed to spot. Many large incidents begin with a phishing email, so recognising phishing and social engineering is part of prevention.
Your role as a member of staff
You are not expected to decide whether something is reportable, only to raise it quickly. HHS requires covered entities to have written breach policies, train their workforce on them and apply sanctions when they are not followed (HHS, 2013). In practice:
- Report immediately to your privacy officer or the channel your policy names.
- Record the facts: what happened, when, what information and how many patients.
- Contain it if you safely can, for example by asking a wrong recipient to delete an email.
- Leave notices to the formal process; do not contact patients or the press yourself.
- Be open about your own mistakes. Fast reporting gives the best chance of reducing harm.
For larger incidents, the notification process runs alongside your incident response plan. Our article on ransomware and cyber incident response explains how those first hours usually unfold.
Frequently asked questions
Is every privacy mistake a reportable breach?
No. An exception may apply, or a documented risk assessment may show a low probability of compromise. Your privacy team makes that call, so always report and let them assess it.
When does the 60-day clock start?
On discovery, which includes when a workforce member knows, or should reasonably have known, about the breach. Delaying an internal report does not pause the clock.
Does a missing encrypted device need reporting?
Report it internally. If it was encrypted in line with HHS guidance, the data is not "unsecured" PHI and notification may not be required, but the privacy officer must confirm that.
Can I be disciplined for reporting my own error?
Policies differ, but hiding an incident is far more serious than reporting it promptly. Check how your organisation's policy treats self-reporting.
The rule works best when every member of staff knows what to look for and who to tell. Learnsignal's healthcare compliance CPD courses offer practical refresher learning for your team. This article is general information, not legal advice.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team
