Last verified: October 2026, against 45 CFR 164.400–414 on eCFR and HHS's breach portal. General information, not legal advice — confirm with your compliance officer or attorney. Call counsel early.
The HIPAA breach notification rule tells your practice what to do when patient information ends up somewhere it shouldn't: decide whether it is a reportable breach, then notify affected patients, HHS and sometimes the media, on fixed deadlines. This page is a runbook for that day, with the website and marketing incidents small practices actually face, from misrouted form emails to tracking pixels.
In short: A breach is an impermissible use or disclosure of PHI that compromises it, presumed unless a four-factor risk assessment shows low probability of compromise. Properly encrypted data is exempt. Notify patients within 60 days of discovery at most, HHS at the same time for 500+ people or annually for fewer, and media for 500+ in a state.
What counts as a breach (and what doesn't)
45 CFR 164.402 (opens in a new tab) defines a breach as "the acquisition, access, use, or disclosure of protected health information in a manner not permitted" by the Privacy Rule "which compromises the security or privacy of the protected health information." It starts with PHI, so if you're unsure what qualifies, check what is PHI.
Three situations are excluded:
- Unintentional, good-faith access by a workforce member acting within their authority, with no further impermissible use. A biller opens the wrong patient's account, realizes it and closes it.
- Inadvertent disclosure between people authorized to access PHI at the same practice, vendor or organized health care arrangement, with no further impermissible use.
- A disclosure where you have a good-faith belief the recipient "would not reasonably have been able to retain" the information. A letter returned unopened by the post office is the textbook case.
Everything else that is impermissible "is presumed to be a breach" unless you document a low probability of compromise. Many HIPAA violation examples never become breaches; this presumption is what decides which ones do.
The four-factor risk assessment
To rebut the presumption, 164.402 requires a risk assessment of "at least the following factors":
- The nature and extent of the PHI, "including the types of identifiers and the likelihood of re-identification." A name and appointment date is different from a diagnosis and Social Security number.
- The unauthorized person who used it or received it. Another covered entity bound by HIPAA is lower risk than an unknown third party.
- Whether the PHI was actually acquired or viewed. Forensic logs showing a file was never opened matter.
- The extent to which the risk has been mitigated, for example a recipient's signed statement that they deleted the email.
Write it down either way. Under 164.414(b) (opens in a new tab), the practice carries "the burden of demonstrating" that notifications were made or that the incident wasn't a breach. Your HIPAA risk assessment should already map where data lives, which speeds this up.
Unsecured PHI and the encryption safe harbor
Notification duties apply only to "unsecured protected health information": PHI not "rendered unusable, unreadable, or indecipherable to unauthorized persons" through methods HHS specifies. When HHS first published that guidance in the Federal Register in 2009 (opens in a new tab), it named two methods:
- Encryption, with valid processes for data at rest "consistent with NIST Special Publication 800-111," and for data in motion complying with NIST SP 800-52, 800-77 or 800-113, or FIPS 140-2 validated. The decryption key must not be breached, and HHS advised storing keys "on a device or at a location separate from the data."
- Destruction: paper "shredded or destroyed such that the PHI cannot be read or otherwise cannot be reconstructed" (redaction doesn't count), and electronic media "cleared, purged, or destroyed consistent with NIST Special Publication 800-88."
So a stolen laptop with full-disk encryption and a strong, separate password is usually not a notifiable breach. The same laptop without encryption is presumed to be one unless your risk assessment shows otherwise.
Who to notify: patients, HHS, media
| Who | When it applies | How |
|---|---|---|
| Each affected patient | Every breach of unsecured PHI | First-class mail, or email if the patient agreed to electronic notice |
| Substitute notice | Contact details missing or out of date | Fewer than 10 people: phone or other written notice. 10 or more: 90-day home-page posting or major media, plus a toll-free number active 90 days |
| HHS | Every breach | Through HHS's breach portal (opens in a new tab) |
| Prominent media | More than 500 residents of a state or jurisdiction | Media outlets serving that area |
Under 164.404(c) (opens in a new tab), the patient letter must be in plain language and include what happened (with dates), the types of PHI involved, steps patients should take, what you're doing about it, and how to reach you, including "a toll-free telephone number, an e-mail address, Web site, or postal address." OCR's portal says it investigates all breaches affecting 500 or more people.
State breach-notification laws may add requirements and shorter deadlines, so check yours with counsel. The FTC's Health Breach Notification Rule, by contrast, does not apply (opens in a new tab) to HIPAA-covered entities or to companies acting as their business associates. Canadian clinics follow different rules; see breach reporting in Canada.
Deadlines that apply
- Discovery is the first day the breach is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it. The clock doesn't wait for the manager to hear about it.
- Patients: without unreasonable delay and "in no case later than 60 calendar days after discovery."
- Media (more than 500 in a state): the same 60-day limit (opens in a new tab).
- HHS, 500 or more people: contemporaneously (opens in a new tab) with patient notice.
- HHS, fewer than 500: keep a log and report "not later than 60 days after the end of each calendar year."
- Law enforcement delay: if police say notice would impede an investigation, 164.412 (opens in a new tab) lets you delay; an oral request allows no more than 30 days unless confirmed in writing.
Website and marketing breaches: real-world scenarios
Illustrative examples: the scenarios describe fictional practices.
A pixel sending appointment data. A chiropractic clinic finds that its ad pixel has been firing on the booking confirmation page for eight months, sending page URLs that include the visit type. Steps: remove the pixel, document which data was sent and for how long, run the four factors (the recipient is an ad platform with no BAA), and involve counsel. See tracking pixel breaches.
Form notifications to a former employee. A dermatology practice's contact form still emails full submissions to a front-desk staffer who left in March. Steps: reroute notifications, disable or secure the old mailbox, check its access logs, and assess whether anyone viewed the messages after departure.
A public link to a lead spreadsheet. A med spa's marketing coordinator shared a cloud spreadsheet of consultation requests "with anyone with the link" to an agency without a BAA. Steps: restrict the link, review the file's access history, ask the agency for written confirmation of deletion, and assess.
In each case, the fix is the easy part; the documentation is what proves you handled it, since the burden of proof is yours. A free marketing audit can show whether pixels on your patient forms are sending data today.
When your vendor has the breach
Under 164.410 (opens in a new tab), a business associate must notify your practice "without unreasonable delay and in no case later than 60 calendar days after discovery," identifying each affected individual where possible and passing on the information your patient letters need. Your practice, as the covered entity, then owns notice to patients, HHS and media; the contract can set who drafts and pays for the letters.
That is why the breach clause matters: how fast the vendor must tell you (you can negotiate fewer days than the legal maximum), who pays for notification, and who drafts the letters. See BAA breach clauses. Medfy stores patient data from its forms, chat and inbox in separate, encrypted HIPAA databases in the US or Canada, and signs a BAA with every practice before any patient data flows; read how Medfy protects patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
How long do you have to report a HIPAA breach?
Patients must be notified without unreasonable delay and no later than 60 calendar days after you discover the breach. Sixty days is a ceiling, not a target. For 500 or more people, HHS is notified at the same time; for fewer than 500, you log the breach and report it to HHS within 60 days after the end of the calendar year. Call counsel early to confirm your deadlines.
Is a lost encrypted laptop a breach?
Usually not a reportable one, if the encryption meets HHS's guidance and the decryption key wasn't lost or compromised with it. The notification duties apply to unsecured PHI, and properly encrypted data counts as secured. Document the encryption, the key's location and how you reached that conclusion. An unencrypted laptop is presumed a breach unless a risk assessment shows a low probability of compromise. Confirm with your compliance officer or attorney.
Do we have to tell patients about a small breach?
Yes. Every affected person must be notified, whether the breach involves one patient or thousands, unless an exception applies or your documented risk assessment shows a low probability that the PHI was compromised. Size changes the HHS and media steps, not the duty to the patient. Breaches under 500 people go into an annual report to HHS. Confirm each case with your compliance officer or attorney.
Who reports a breach caused by a vendor?
The vendor must notify your practice without unreasonable delay and within 60 days of its discovery, identifying each affected person where possible. Your practice, as the covered entity, then remains responsible for notifying patients, HHS and, if needed, the media. Your business associate agreement can set who drafts and pays for the letters. Check its breach clause now, before you need it, with your attorney.