HIPAA Breach Notification Rules: 60-Day Deadline and Penalties

Under the HIPAA breach notification requirements, a healthcare organization that discovers unauthorized exposure of unsecured protected health information must tell every affected patient, the Department of Health and Human Services, and sometimes the media, all within 60 calendar days. Missing that deadline, or handling the breach carelessly, can trigger civil fines starting at $145 per violation and, in the worst cases, federal criminal charges.

What Counts as a Breach

Federal regulations define a breach as any unauthorized access, use, or disclosure of protected health information that compromises its security or privacy.¹ The rule builds in a presumption that cuts against the organization: any impermissible use or disclosure is treated as a breach unless a documented risk assessment shows a low probability that the data was actually compromised.

That assessment has to weigh four factors:

The type and scope of data involved, including what identifiers were exposed and how easily a patient could be re-identified.
Who received or accessed the information, and whether that person is bound by privacy obligations.
Whether the data was actually viewed or acquired, versus merely accessible.
How effectively the risk was contained after the fact, such as through confidentiality agreements or confirmed destruction.

If the analysis cannot demonstrate a low probability of compromise, the organization must treat the incident as a breach and notify.² The burden of proof stays with the covered entity or business associate: if HHS asks, they must show either that all required notifications went out or that the incident did not meet the breach definition.³

One important boundary: the rule applies only to unsecured PHI. Data that has been encrypted or destroyed according to HHS-specified standards falls outside the notification requirement entirely.¹ A stolen laptop with a properly encrypted hard drive, where the decryption key is stored separately, generally does not trigger notification.⁴ Redaction alone does not qualify as destruction.

Three Narrow Exceptions

Even when PHI is unsecured, three specific situations fall outside the breach definition:

A workforce member accidentally accesses PHI in good faith and within the scope of their job, and the data is not further used or disclosed improperly.
One authorized person at a covered entity inadvertently shares PHI with another authorized person at the same organization, again with no further improper use.
The organization has a good-faith belief that the unauthorized recipient could not reasonably have retained the information, such as a misaddressed fax that the recipient immediately confirms was shredded.

An organization relying on any of these still has to document why the exception applies and produce that documentation if HHS investigates.¹

Who Is Responsible for Notifying

The duty to notify patients belongs to covered entities: health plans, healthcare clearinghouses, and healthcare providers that transmit information electronically for standard transactions like billing.⁵ A practice that never sends electronic claims is not technically a covered entity, though that scenario is rare today.

Business associates, meaning vendors that handle PHI for a covered entity, have a different obligation. When a business associate discovers a breach, it must notify the covered entity within 60 calendar days.⁶ The covered entity, not the vendor, handles patient notification. The specifics are usually spelled out in the business associate agreement between the two.

Companies that collect health-related data but sit outside HIPAA’s definitions, such as consumer health apps and fitness trackers, may still be subject to the FTC Health Breach Notification Rule, which has its own timelines and penalties.⁷ Being outside HIPAA is not the same as being exempt from breach reporting.

The 60-Day Deadline and When It Starts

A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach.⁸ Sixty days is the outer limit, not a target. Sitting on a discovered breach for 59 days without a good reason can itself draw enforcement action for unreasonable delay.

The clock starts on the day the breach is known, or through reasonable diligence should have been known, to any workforce member or agent of the covered entity, other than the person who committed the breach. That trigger is broad. If a nurse spots suspicious access in an audit log on March 1, the clock starts March 1, even if the privacy officer does not hear about it until March 15. Organizations that lack fast internal escalation are quietly shortening their own response window.

How Notices Reach People

The default method is a first-class letter to the individual’s last known address. Email is acceptable only if the person previously agreed to electronic communications and has not withdrawn that consent.⁸ When the affected individual is known to be deceased and the entity has an address for the next of kin or personal representative, the letter goes there.

When contact information is outdated for some affected people, the rule splits the response by scale. For fewer than 10 unreachable individuals, the entity can use an alternative method such as a phone call or a different written form. For 10 or more, the entity must either post a conspicuous notice on its website homepage for at least 90 days, or run a notice in major print or broadcast media serving the affected area. Either substitute must include a toll-free number, active for at least 90 days, that people can call to find out whether they were affected.

In urgent situations where misuse of the exposed data appears imminent, entities may also reach out by phone or other fast methods in addition to the standard written notice.

What the Notice Must Say

The content of every breach notification is set by regulation. Each notice must include, to the extent possible:

A plain description of what happened, including the date of the breach and the date of discovery if known.
The types of unsecured data involved, such as names, Social Security numbers, dates of birth, diagnoses, or account numbers.
Concrete steps the individual can take to protect themselves, such as credit monitoring or fraud alerts.
What the organization is doing to investigate, mitigate harm, and prevent recurrence.
Contact information, including a toll-free number, email, website, or postal address, for questions.

The “to the extent possible” language acknowledges that some facts may still be unknown when the letter goes out.⁸ Follow-up mailings are permitted; the initial notice does not have to wait until every detail is confirmed.

Reporting to HHS and the Media

Individual notification is only part of the obligation. Covered entities must also report breaches to the Secretary of Health and Human Services, and the reporting timeline depends on the size of the breach.

500 or More Affected Individuals

For large breaches, the covered entity must submit an electronic report through the HHS breach reporting portal within 60 calendar days of discovery.⁹ HHS then posts these reports to a public, searchable database.

Large breaches also trigger media notification, but only under a specific condition. When more than 500 residents of a single state or jurisdiction are affected, the covered entity must notify prominent media outlets serving that area within 60 calendar days.¹⁰ The media notice carries the same content requirements as the individual letter. A breach affecting 500 people spread thinly across many states, with no single state hitting the 500 threshold, requires HHS reporting but not media notice.

Fewer Than 500 Affected Individuals

Smaller breaches do not require immediate HHS reporting. The entity logs each incident and submits the reports within 60 days after the end of the calendar year in which the breach was discovered.⁹ A 50-person breach found in March 2026 would be reportable by March 1, 2027. The 60-day individual notification deadline still applies regardless of size.

Law Enforcement Delay

A covered entity or business associate must postpone notification if a law enforcement official states that notice would interfere with a criminal investigation or damage national security. A written request must specify the delay period, and the entity must wait for the stated time. An oral request buys no more than 30 days from the date it was made, and the entity must document who made the request; a follow-up written request during that window can extend it.¹¹ Once the delay ends, the notification obligation resumes.

Penalties for Getting It Wrong

HHS enforces the rule through the Office for Civil Rights, which can impose civil monetary penalties on a four-tier scale keyed to the entity’s level of fault. The 2026 inflation-adjusted ranges are:

Tier 1, did not know and could not reasonably have known: $145 to $73,011 per violation.
Tier 2, reasonable cause but not willful neglect: $1,461 to $73,011 per violation.
Tier 3, willful neglect that was corrected within 30 days: $14,602 to $73,011 per violation.
Tier 4, willful neglect not corrected within 30 days: $73,011 to $2,190,294 per violation.

Each tier carries an annual cap of $2,190,294 for multiple violations of the same provision in a single calendar year.¹² The dollar amounts adjust each year for inflation.

Criminal Penalties

The Department of Justice can bring separate criminal charges against anyone who knowingly obtains or discloses individually identifiable health information in violation of HIPAA. There are three tiers:

Basic violation: up to $50,000 and one year in prison.
Under false pretenses: up to $100,000 and five years in prison.
For commercial gain or malicious harm: up to $250,000 and ten years in prison.

The “knowingly” standard does not require the person to know they are violating HIPAA specifically; knowing the underlying conduct is unauthorized is enough.¹³ Criminal cases are less common than civil enforcement, but they do occur, often involving employees who access celebrity records or sell patient data.

State Laws Can Be Stricter

HIPAA sets a federal floor, not a ceiling. Roughly 15 states impose breach notification deadlines shorter than 60 days, and some require notice within 30. An organization that meets the HIPAA deadline but misses a stricter state deadline can still face state enforcement and private lawsuits. If you operate in more than one state, map the obligations under each applicable law rather than relying on the federal timeline alone.

1
eCFR. 45 CFR 164.402 – Definitions
2
U.S. Department of Health and Human Services. Breach Notification Rule
3
eCFR. 45 CFR 164.414 – Administrative Requirements and Burden of Proof
4
U.S. Department of Health and Human Services. Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals
5
U.S. Department of Health and Human Services. Covered Entities and Business Associates
6
eCFR. 45 CFR 164.410 – Notification by a Business Associate
7
Federal Trade Commission. Complying with FTCs Health Breach Notification Rule
8
eCFR. 45 CFR 164.404 – Notification to Individuals
9
U.S. Department of Health and Human Services. Submitting Notice of a Breach to the Secretary
10
eCFR. 45 CFR 164.406 – Notification to the Media
11
GovInfo. 45 CFR 164.412 – Law Enforcement Delay
12
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
13
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information