HIPAA Breach Notification Rule: Four Factors and 500

Under HIPAA, an impermissible use or disclosure of protected health information is presumed to be a breach, and the organisation has to prove otherwise with a documented four-factor risk assessment or notify within 60 days. The Breach Notification Rule at 45 CFR 164.400 to 164.414 is separate from the Security Rule: the Security Rule says how to protect ePHI, the Breach Notification Rule says what happens when that protection fails. This guide covers who is covered, the definition and its exceptions, the four-factor assessment, the notification clocks for individuals, media and HHS, the 500 individual threshold, business associate duties, penalties and how the rule applies to leaked credentials, service accounts and AI agents. It is for security, privacy and incident response leads at covered entities and business associates. For safeguards, see the HIPAA Security Rule Guide.

Status checked 27 October 2026: the rule text in the eCFR (up to date as of 22 October 2026) is unchanged in substance. Since 16 February 2026, the same breach notification requirements also apply to substance use disorder records covered by 42 CFR Part 2. Proposed Security Rule amendments do not change the breach notification provisions; check HHS for their status.

Key takeaways

Presumed breach: 45 CFR 164.402 presumes an impermissible use or disclosure is a breach unless a risk assessment of four factors shows a low probability that the PHI has been compromised.
60 calendar days is an outer limit: individual notice is due without unreasonable delay and in no case later than 60 calendar days after discovery, and discovery is the first day any workforce member or agent knew or should reasonably have known.
500 changes the audience: 500 or more affected individuals means HHS is notified at the same time as individuals; more than 500 residents of one State or jurisdiction also means prominent media notice.
Encryption is a safe harbour only if the key is safe: PHI encrypted to HHS guidance is not "unsecured", but not if the key was compromised, and HHS says full disk encryption does not help when ransomware runs in a logged-in session.
You carry the burden of proof: 164.414 places the burden on the covered entity or business associate to show that notifications were made or that no breach occurred, so the documented assessment is the defence.

Scope: who and what is covered

The rule applies to HIPAA covered entities (health plans, healthcare clearinghouses and providers that transmit health information electronically in standard transactions) and their business associates. It is triggered only by unsecured protected health information, meaning PHI not rendered unusable, unreadable or indecipherable to unauthorised persons through a technology or method that HHS specifies in guidance.

Element	Rule	Source
Breach	Acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule which compromises its security or privacy	45 CFR 164.402
Exception 1	Unintentional, good faith access or use by a workforce member or person acting under the entity's authority, within scope of authority, with no further impermissible use or disclosure	164.402(1)(i)
Exception 2	Inadvertent disclosure between persons authorised to access PHI at the same covered entity, business associate or organised health care arrangement, with no further impermissible use or disclosure	164.402(1)(ii)
Exception 3	Good faith belief that the unauthorised recipient would not reasonably have been able to retain the information	164.402(1)(iii)
Unsecured PHI	PHI not secured to HHS guidance: encryption or destruction	164.402; HHS guidance
Part 2 records	Same breach notification requirements apply from 16 February 2026	HHS Part 2 final rule fact sheet
Personal health record vendors	Not HIPAA; covered by the FTC Health Breach Notification Rule	HHS breach notification page

What counts as secured

Data at rest: encryption consistent with NIST SP 800-111.
Data in motion: NIST SP 800-52 (TLS), SP 800-77 (IPsec VPNs) or SP 800-113 (SSL VPNs), or other methods validated under FIPS 140-2.
Key protection: the decryption key or process must not have been breached, and HHS advises storing keys separately from the data.
Destruction: paper shredded so it cannot be reconstructed (redaction does not qualify); electronic media cleared, purged or destroyed according to NIST SP 800-88.

Key obligations

The four-factor risk assessment

If no exception applies and the PHI was unsecured, the entity either notifies or documents an assessment showing a low probability of compromise. The four factors are mandatory minimums, not a scoring scale.

Factor (164.402(2))	Questions to answer	Evidence to keep
(i) Nature and extent of the PHI	Which identifiers and clinical or financial data, and how likely is re-identification?	Data element inventory for the affected records, sample review
(ii) Unauthorised person	Who used or received it: another HIPAA-bound entity, an employee, an unknown attacker?	Recipient identity, their obligations, attestation of deletion where available
(iii) Actually acquired or viewed	Did anyone open, download or exfiltrate it, or was there only an opportunity?	Access logs, DLP, egress and cloud storage logs, forensic report
(iv) Extent of mitigation	Was the data retrieved, destroyed or protected by assurances; were credentials revoked?	Signed assurances, revocation records, timeline

Ransomware: HHS's ransomware fact sheet states that when ransomware encrypts ePHI, a breach has occurred because the ePHI was acquired, unless the entity can show low probability of compromise. Exfiltration, loss of integrity (originals deleted) and loss of availability all weigh in the assessment, and well-tested backups can be evidence of mitigated integrity impact. See the Ransomware Response and Recovery Guide.

Who to notify and when

Recipient	Trigger	Deadline	Section
Affected individuals	Any breach of unsecured PHI	Without unreasonable delay, no later than 60 calendar days after discovery	164.404
Prominent media outlets	More than 500 residents of a State or jurisdiction	Same 60 day limit	164.406
HHS Secretary (500 or more)	500 or more individuals	Contemporaneously with individual notice, through the HHS portal	164.408(b)
HHS Secretary (fewer than 500)	Fewer than 500 individuals	Log, then report within 60 days after the end of the calendar year of discovery	164.408(c)
Covered entity (from business associate)	Business associate discovers a breach	Without unreasonable delay, no later than 60 calendar days after discovery	164.410

Content of the individual notice (164.404(c)): in plain language, a brief description with the breach and discovery dates if known; the types of unsecured PHI involved; steps individuals should take to protect themselves; what the entity is doing to investigate, mitigate and prevent recurrence; and contact procedures including a toll-free number, email address, website or postal address.
Method (164.404(d)): first-class mail to the last known address, or email if the individual agreed to electronic notice; next of kin or personal representative for deceased individuals where the address is known.
Substitute notice: for fewer than 10 people with out-of-date contact details, an alternative written notice, telephone or other means; for 10 or more, a conspicuous home page posting for 90 days or major print or broadcast media notice, plus a toll-free number active for at least 90 days.
Urgent cases: telephone or other means in addition to written notice where misuse may be imminent.
Business associate content: identification of each affected individual to the extent possible, and other information the covered entity needs for its notice.
Law enforcement delay (164.412): a written statement that notice would impede an investigation delays notice for the period it specifies; an oral statement must be documented and delays notice no more than 30 days unless a written statement follows.

The 500 threshold in practice

The count is of individuals affected by the breach, not records. Media notice is assessed per State or jurisdiction, so a 900 person breach split 450 and 450 across two States needs HHS notice at the time of individual notice but no media notice. Breaches of 500 or more appear on the HHS OCR breach portal, which OCR says it investigates in every case; smaller breaches may be investigated depending on resources and priorities.

Timeline and current status

Date	Event
2009	HITECH Act creates the breach notification duty; HHS issues the interim rule and guidance on securing PHI
2013	Omnibus Rule finalises the presumption of breach and the four-factor assessment, replacing the earlier harm standard
8 February 2024	HHS announces the 42 CFR Part 2 final rule applying breach notification to Part 2 records
16 February 2026	Compliance date for the Part 2 final rule
22 October 2026	eCFR text of Subpart D checked for this guide

The rule has been stable since 2013. HHS has proposed changes to the Security Rule (see the HHS HIPAA Security Rule Update (2025 NPRM) Guide), but those do not alter Subpart D. State breach laws can apply in parallel to the same incident with shorter clocks or attorney general notice, so check them alongside HIPAA using the Data Breach Notification Checklist.

Enforcement and penalties

HHS OCR enforces the rule through complaints, breach report investigations and compliance reviews, and resolves cases with resolution agreements, corrective action plans or civil money penalties. Penalty amounts are adjusted for inflation each year in 45 CFR 102.3.

Culpability tier (violations on or after 18 February 2009)	2025 maximum per violation
Did not know and, with reasonable diligence, would not have known	$73,011
Reasonable cause and not willful neglect	$73,011
Willful neglect, corrected within 30 days	$73,011
Willful neglect, not corrected within 30 days	$2,190,294
Calendar year cap for identical violations	$2,190,294

Each missing notice can be a violation: late or absent notice to individuals, media and HHS are separate obligations, and the breach itself usually exposes Security Rule failings such as an absent risk analysis.
The assessment is examined: OCR can ask for the four-factor documentation for an incident you decided not to notify. Without it, 164.414 means the presumption stands.
Recent activity: OCR's resolution agreements page lists settlements through September 2026, including a ransomware case in July 2026.

What it means for AI agents and non-human identities

Most large healthcare breaches start with a credential, and many of those credentials belong to systems rather than people. The rule does not care what kind of identity was used: if an unauthorised party used it to access unsecured PHI, the presumption applies. The Change Healthcare breach began with a remote access login without MFA and showed how one vendor incident can create notification work across many organisations.

Scenario	Breach Notification Rule reading	What to have ready
API key or service account token for an EHR integration leaked in a public repository	Opportunity to access is not automatic notification, but factor (iii) needs evidence of whether data was actually acquired	Per-credential API logs retained long enough to cover the exposure window
AI agent with PHI access sends records to the wrong recipient or tool	An impermissible disclosure; exception 2 applies only if the recipient is authorised within the same entity or arrangement	Agent action logs with recipient, data and delegating user
Prompt or output containing PHI sent to an AI service without a business associate agreement	Disclosure not permitted by the Privacy Rule; assess the four factors, including the provider's retention terms	Inventory of AI services, contracts and data flows; see the Health Data Privacy Beyond HIPAA Guide (My Health My Data)
Ransomware run with a compromised backup or RMM service account	HHS treats encryption by ransomware as acquisition; breach presumed	Tested restores, exfiltration analysis, revocation record
Laptop or database encrypted at rest but keys held in the same compromised account	Not secured if the key was breached	Key management records showing separation

Logging decides the outcome: factor (iii) is the one that most often allows a low probability conclusion, and it depends entirely on whether you can show what a machine identity did. Short log retention on integration accounts turns a contained exposure into a notifiable breach.
Revocation is mitigation: factor (iv) rewards fast credential rotation. Record when each key, token or agent credential was revoked. See the API Key Management Guide.
Discovery clock for agents: discovery is knowledge by any workforce member or agent. An alert raised by monitoring that nobody triages may still start the clock if the breach would have been known with reasonable diligence.

Framework mapping

Rule element	NIST CSF 2.0	NIST SP 800-53 Rev 5
Discovery and assessment	DE.AE-04, RS.AN-03	IR-4, AU-6
Notification to individuals, media, HHS	RS.CO-02, RS.CO-03	IR-6
Secured PHI (encryption, destruction)	PR.DS-01, PR.DS-02	SC-28, SC-8, MP-6
Credential revocation as mitigation	PR.AA-01	IA-5, AC-2
Burden of proof and documentation	RS.MA-02	IR-5, IR-8

Compliance steps

Write the decision procedure: a flow from incident to "PHI involved?", "secured?", "exception applies?", four-factor assessment, and notification decision, with named owners and the 60 day clock calculated from discovery.
Define discovery: train staff and configure the SOC so that the date a breach is known, or should have been known, is recorded on the incident ticket.
Build the assessment template: one section per factor with evidence fields, sign-off by privacy and security, and retention for six years alongside other HIPAA documentation.
Prepare notices in advance: letter, substitute web notice, media statement and call centre script with the 164.404(c) elements, and a mail vendor contract.
Fix business associate terms: contractual notice faster than 60 days, a list of affected individuals, and cooperation duties. Include AI and SaaS providers that touch PHI.
Prepare the evidence base: log retention for integration accounts, API gateways and agent actions; an inventory of PHI stores and the identities that can reach them.
Exercise it: run a tabletop with a leaked integration key and a ransomware case each year, and adjust the procedure.

Detection and measurement

Time to discovery record: days from first indicator to recorded discovery date.
Time to notify: days from discovery to individual notice; target well under 60.
Assessment completeness: percentage of PHI incidents with a signed four-factor assessment, whether notified or not; target 100%.
Log coverage: share of non-human identities with PHI access whose actions are logged and retained for at least the assessment window.
Revocation time: hours from detection to revocation for compromised keys or tokens.
Annual log accuracy: reconciliation of sub-500 breaches with the annual HHS submission.

Common failure patterns

Starting the clock at the forensic report: discovery is when the breach was known or reasonably should have been, not when an investigation concludes.
Using 60 days as the target: the standard is without unreasonable delay; waiting to day 59 with information already in hand is itself a risk.
Assuming encryption covers ransomware: transparent full disk encryption does not protect data accessed in a live session.
No logs for machine identities: without them factor (iii) cannot be argued and the presumption wins.
Undocumented "no breach" decisions: an informal conclusion is not a defence under 164.414.
Ignoring vendors and AI tools: PHI sent to a service with no business associate agreement is a disclosure that needs assessment.

Practitioner checklist

Map the decision flow from PHI involved to notify or document.
Record the discovery date on every incident ticket.
Use a four-factor template with evidence, and keep it for six years.
Confirm encryption meets HHS guidance and keys are stored separately.
Pre-draft individual, substitute, media and HHS portal content.
Require business associates, including AI and SaaS vendors, to notify quickly with individual lists.
Log and retain actions of service accounts, API keys and AI agents that reach PHI.
Maintain the sub-500 log and submit it within 60 days of year end.
Check State breach laws for every incident alongside HIPAA.

Standards and references

This guide summarises the HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414) as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: HIPAA Security Rule Guide · FTC Health Breach Notification Rule Guide · Breach Notification Laws by Country Guide

HIPAA Breach Notification Rule Guide: Four-Factor Risk Assessment and the 500 Threshold