Under HIPAA, an impermissible use or disclosure of protected health information is presumed to be a breach, and the organisation has to prove otherwise with a documented four-factor risk assessment or notify within 60 days. The Breach Notification Rule at 45 CFR 164.400 to 164.414 is separate from the Security Rule: the Security Rule says how to protect ePHI, the Breach Notification Rule says what happens when that protection fails. This guide covers who is covered, the definition and its exceptions, the four-factor assessment, the notification clocks for individuals, media and HHS, the 500 individual threshold, business associate duties, penalties and how the rule applies to leaked credentials, service accounts and AI agents. It is for security, privacy and incident response leads at covered entities and business associates. For safeguards, see the HIPAA Security Rule Guide.
Status checked 27 October 2026: the rule text in the eCFR (up to date as of 22 October 2026) is unchanged in substance. Since 16 February 2026, the same breach notification requirements also apply to substance use disorder records covered by 42 CFR Part 2. Proposed Security Rule amendments do not change the breach notification provisions; check HHS for their status.
Key takeaways
- Presumed breach: 45 CFR 164.402 presumes an impermissible use or disclosure is a breach unless a risk assessment of four factors shows a low probability that the PHI has been compromised.
- 60 calendar days is an outer limit: individual notice is due without unreasonable delay and in no case later than 60 calendar days after discovery, and discovery is the first day any workforce member or agent knew or should reasonably have known.
- 500 changes the audience: 500 or more affected individuals means HHS is notified at the same time as individuals; more than 500 residents of one State or jurisdiction also means prominent media notice.
- Encryption is a safe harbour only if the key is safe: PHI encrypted to HHS guidance is not "unsecured", but not if the key was compromised, and HHS says full disk encryption does not help when ransomware runs in a logged-in session.
- You carry the burden of proof: 164.414 places the burden on the covered entity or business associate to show that notifications were made or that no breach occurred, so the documented assessment is the defence.
Scope: who and what is covered
The rule applies to HIPAA covered entities (health plans, healthcare clearinghouses and providers that transmit health information electronically in standard transactions) and their business associates. It is triggered only by unsecured protected health information, meaning PHI not rendered unusable, unreadable or indecipherable to unauthorised persons through a technology or method that HHS specifies in guidance.
| Element | Rule | Source |
|---|---|---|
| Breach | Acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule which compromises its security or privacy | 45 CFR 164.402 |
| Exception 1 | Unintentional, good faith access or use by a workforce member or person acting under the entity's authority, within scope of authority, with no further impermissible use or disclosure | 164.402(1)(i) |
| Exception 2 | Inadvertent disclosure between persons authorised to access PHI at the same covered entity, business associate or organised health care arrangement, with no further impermissible use or disclosure | 164.402(1)(ii) |
| Exception 3 | Good faith belief that the unauthorised recipient would not reasonably have been able to retain the information | 164.402(1)(iii) |
| Unsecured PHI | PHI not secured to HHS guidance: encryption or destruction | 164.402; HHS guidance |
| Part 2 records | Same breach notification requirements apply from 16 February 2026 | HHS Part 2 final rule fact sheet |
| Personal health record vendors | Not HIPAA; covered by the FTC Health Breach Notification Rule | HHS breach notification page |
What counts as secured
- Data at rest: encryption consistent with NIST SP 800-111.
- Data in motion: NIST SP 800-52 (TLS), SP 800-77 (IPsec VPNs) or SP 800-113 (SSL VPNs), or other methods validated under FIPS 140-2.
- Key protection: the decryption key or process must not have been breached, and HHS advises storing keys separately from the data.
- Destruction: paper shredded so it cannot be reconstructed (redaction does not qualify); electronic media cleared, purged or destroyed according to NIST SP 800-88.
Key obligations
The four-factor risk assessment
If no exception applies and the PHI was unsecured, the entity either notifies or documents an assessment showing a low probability of compromise. The four factors are mandatory minimums, not a scoring scale.
| Factor (164.402(2)) | Questions to answer | Evidence to keep |
|---|---|---|
| (i) Nature and extent of the PHI | Which identifiers and clinical or financial data, and how likely is re-identification? | Data element inventory for the affected records, sample review |
| (ii) Unauthorised person | Who used or received it: another HIPAA-bound entity, an employee, an unknown attacker? | Recipient identity, their obligations, attestation of deletion where available |
| (iii) Actually acquired or viewed | Did anyone open, download or exfiltrate it, or was there only an opportunity? | Access logs, DLP, egress and cloud storage logs, forensic report |
| (iv) Extent of mitigation | Was the data retrieved, destroyed or protected by assurances; were credentials revoked? | Signed assurances, revocation records, timeline |
Ransomware: HHS's ransomware fact sheet states that when ransomware encrypts ePHI, a breach has occurred because the ePHI was acquired, unless the entity can show low probability of compromise. Exfiltration, loss of integrity (originals deleted) and loss of availability all weigh in the assessment, and well-tested backups can be evidence of mitigated integrity impact. See the Ransomware Response and Recovery Guide.
Who to notify and when
| Recipient | Trigger | Deadline | Section |
|---|---|---|---|
| Affected individuals | Any breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery | 164.404 |
| Prominent media outlets | More than 500 residents of a State or jurisdiction | Same 60 day limit | 164.406 |
| HHS Secretary (500 or more) | 500 or more individuals | Contemporaneously with individual notice, through the HHS portal | 164.408(b) |
| HHS Secretary (fewer than 500) | Fewer than 500 individuals | Log, then report within 60 days after the end of the calendar year of discovery | 164.408(c) |
| Covered entity (from business associate) | Business associate discovers a breach | Without unreasonable delay, no later than 60 calendar days after discovery | 164.410 |
- Content of the individual notice (164.404(c)): in plain language, a brief description with the breach and discovery dates if known; the types of unsecured PHI involved; steps individuals should take to protect themselves; what the entity is doing to investigate, mitigate and prevent recurrence; and contact procedures including a toll-free number, email address, website or postal address.
- Method (164.404(d)): first-class mail to the last known address, or email if the individual agreed to electronic notice; next of kin or personal representative for deceased individuals where the address is known.
- Substitute notice: for fewer than 10 people with out-of-date contact details, an alternative written notice, telephone or other means; for 10 or more, a conspicuous home page posting for 90 days or major print or broadcast media notice, plus a toll-free number active for at least 90 days.
- Urgent cases: telephone or other means in addition to written notice where misuse may be imminent.
- Business associate content: identification of each affected individual to the extent possible, and other information the covered entity needs for its notice.
- Law enforcement delay (164.412): a written statement that notice would impede an investigation delays notice for the period it specifies; an oral statement must be documented and delays notice no more than 30 days unless a written statement follows.
The 500 threshold in practice
The count is of individuals affected by the breach, not records. Media notice is assessed per State or jurisdiction, so a 900 person breach split 450 and 450 across two States needs HHS notice at the time of individual notice but no media notice. Breaches of 500 or more appear on the HHS OCR breach portal, which OCR says it investigates in every case; smaller breaches may be investigated depending on resources and priorities.
Timeline and current status
| Date | Event |
|---|---|
| 2009 | HITECH Act creates the breach notification duty; HHS issues the interim rule and guidance on securing PHI |
| 2013 | Omnibus Rule finalises the presumption of breach and the four-factor assessment, replacing the earlier harm standard |
| 8 February 2024 | HHS announces the 42 CFR Part 2 final rule applying breach notification to Part 2 records |
| 16 February 2026 | Compliance date for the Part 2 final rule |
| 22 October 2026 | eCFR text of Subpart D checked for this guide |
The rule has been stable since 2013. HHS has proposed changes to the Security Rule (see the HHS HIPAA Security Rule Update (2025 NPRM) Guide), but those do not alter Subpart D. State breach laws can apply in parallel to the same incident with shorter clocks or attorney general notice, so check them alongside HIPAA using the Data Breach Notification Checklist.
Enforcement and penalties
HHS OCR enforces the rule through complaints, breach report investigations and compliance reviews, and resolves cases with resolution agreements, corrective action plans or civil money penalties. Penalty amounts are adjusted for inflation each year in 45 CFR 102.3.
| Culpability tier (violations on or after 18 February 2009) | 2025 maximum per violation |
|---|---|
| Did not know and, with reasonable diligence, would not have known | $73,011 |
| Reasonable cause and not willful neglect | $73,011 |
| Willful neglect, corrected within 30 days | $73,011 |
| Willful neglect, not corrected within 30 days | $2,190,294 |
| Calendar year cap for identical violations | $2,190,294 |
- Each missing notice can be a violation: late or absent notice to individuals, media and HHS are separate obligations, and the breach itself usually exposes Security Rule failings such as an absent risk analysis.
- The assessment is examined: OCR can ask for the four-factor documentation for an incident you decided not to notify. Without it, 164.414 means the presumption stands.
- Recent activity: OCR's resolution agreements page lists settlements through September 2026, including a ransomware case in July 2026.
What it means for AI agents and non-human identities
Most large healthcare breaches start with a credential, and many of those credentials belong to systems rather than people. The rule does not care what kind of identity was used: if an unauthorised party used it to access unsecured PHI, the presumption applies. The Change Healthcare breach began with a remote access login without MFA and showed how one vendor incident can create notification work across many organisations.
| Scenario | Breach Notification Rule reading | What to have ready |
|---|---|---|
| API key or service account token for an EHR integration leaked in a public repository | Opportunity to access is not automatic notification, but factor (iii) needs evidence of whether data was actually acquired | Per-credential API logs retained long enough to cover the exposure window |
| AI agent with PHI access sends records to the wrong recipient or tool | An impermissible disclosure; exception 2 applies only if the recipient is authorised within the same entity or arrangement | Agent action logs with recipient, data and delegating user |
| Prompt or output containing PHI sent to an AI service without a business associate agreement | Disclosure not permitted by the Privacy Rule; assess the four factors, including the provider's retention terms | Inventory of AI services, contracts and data flows; see the Health Data Privacy Beyond HIPAA Guide (My Health My Data) |
| Ransomware run with a compromised backup or RMM service account | HHS treats encryption by ransomware as acquisition; breach presumed | Tested restores, exfiltration analysis, revocation record |
| Laptop or database encrypted at rest but keys held in the same compromised account | Not secured if the key was breached | Key management records showing separation |
- Logging decides the outcome: factor (iii) is the one that most often allows a low probability conclusion, and it depends entirely on whether you can show what a machine identity did. Short log retention on integration accounts turns a contained exposure into a notifiable breach.
- Revocation is mitigation: factor (iv) rewards fast credential rotation. Record when each key, token or agent credential was revoked. See the API Key Management Guide.
- Discovery clock for agents: discovery is knowledge by any workforce member or agent. An alert raised by monitoring that nobody triages may still start the clock if the breach would have been known with reasonable diligence.
Framework mapping
| Rule element | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Discovery and assessment | DE.AE-04, RS.AN-03 | IR-4, AU-6 |
| Notification to individuals, media, HHS | RS.CO-02, RS.CO-03 | IR-6 |
| Secured PHI (encryption, destruction) | PR.DS-01, PR.DS-02 | SC-28, SC-8, MP-6 |
| Credential revocation as mitigation | PR.AA-01 | IA-5, AC-2 |
| Burden of proof and documentation | RS.MA-02 | IR-5, IR-8 |
Compliance steps
- Write the decision procedure: a flow from incident to "PHI involved?", "secured?", "exception applies?", four-factor assessment, and notification decision, with named owners and the 60 day clock calculated from discovery.
- Define discovery: train staff and configure the SOC so that the date a breach is known, or should have been known, is recorded on the incident ticket.
- Build the assessment template: one section per factor with evidence fields, sign-off by privacy and security, and retention for six years alongside other HIPAA documentation.
- Prepare notices in advance: letter, substitute web notice, media statement and call centre script with the 164.404(c) elements, and a mail vendor contract.
- Fix business associate terms: contractual notice faster than 60 days, a list of affected individuals, and cooperation duties. Include AI and SaaS providers that touch PHI.
- Prepare the evidence base: log retention for integration accounts, API gateways and agent actions; an inventory of PHI stores and the identities that can reach them.
- Exercise it: run a tabletop with a leaked integration key and a ransomware case each year, and adjust the procedure.
Detection and measurement
- Time to discovery record: days from first indicator to recorded discovery date.
- Time to notify: days from discovery to individual notice; target well under 60.
- Assessment completeness: percentage of PHI incidents with a signed four-factor assessment, whether notified or not; target 100%.
- Log coverage: share of non-human identities with PHI access whose actions are logged and retained for at least the assessment window.
- Revocation time: hours from detection to revocation for compromised keys or tokens.
- Annual log accuracy: reconciliation of sub-500 breaches with the annual HHS submission.
Common failure patterns
- Starting the clock at the forensic report: discovery is when the breach was known or reasonably should have been, not when an investigation concludes.
- Using 60 days as the target: the standard is without unreasonable delay; waiting to day 59 with information already in hand is itself a risk.
- Assuming encryption covers ransomware: transparent full disk encryption does not protect data accessed in a live session.
- No logs for machine identities: without them factor (iii) cannot be argued and the presumption wins.
- Undocumented "no breach" decisions: an informal conclusion is not a defence under 164.414.
- Ignoring vendors and AI tools: PHI sent to a service with no business associate agreement is a disclosure that needs assessment.
Practitioner checklist
- Map the decision flow from PHI involved to notify or document.
- Record the discovery date on every incident ticket.
- Use a four-factor template with evidence, and keep it for six years.
- Confirm encryption meets HHS guidance and keys are stored separately.
- Pre-draft individual, substitute, media and HHS portal content.
- Require business associates, including AI and SaaS vendors, to notify quickly with individual lists.
- Log and retain actions of service accounts, API keys and AI agents that reach PHI.
- Maintain the sub-500 log and submit it within 60 days of year end.
- Check State breach laws for every incident alongside HIPAA.
Standards and references
- eCFR: 45 CFR Part 164 Subpart D, Notification in the Case of Breach of Unsecured PHI
- HHS: Breach Notification Rule
- HHS: Guidance to Render Unsecured PHI Unusable, Unreadable, or Indecipherable
- HHS: Fact Sheet, Ransomware and HIPAA
- HHS OCR: Breach Portal
- eCFR: 45 CFR 102.3, Civil Monetary Penalties Adjusted for Inflation
- HHS: Fact Sheet, 42 CFR Part 2 Final Rule
- HHS: Resolution Agreements and Civil Money Penalties
This guide summarises the HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414) as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: HIPAA Security Rule Guide · FTC Health Breach Notification Rule Guide · Breach Notification Laws by Country Guide