United StatesHIPAA Breach Notification Rule
45 CFR Part 164, Subpart D (Sections 164.400-164.414)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
- Notify the Secretary of Health and Human Services of a breach of unsecured protected health information involving 500 or more individuals contemporaneously with the notice to affected individuals.
- Notify the Secretary of Health and Human Services, for breaches of unsecured protected health information involving fewer than 500 individuals that were discovered during a calendar year, not later than 60 days after the end of that calendar year.
- For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
- If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
These lines are LexLint's reading of the law's text. Also read by: HHS Office for Civil Rights (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Knowingly and in violation of HIPAA obtaining or disclosing individually identifiable health information, when done with intent to sell, transfer, or use it for commercial advantage, personal gain, or malicious harm, is a federal crime under 42 U.S.C. 1320d-6(b)(3): a fine of up to $250,000 and imprisonment of up to 10 years, or both.
Penalty structure
45 CFR 160.404 sets four culpability tiers per violation, adjusted for inflation annually and published at 45 CFR 102.3 (2025 figures shown): (i) no knowledge and no reasonable diligence would have revealed the violation, $145 to $73,011 per violation; (ii) reasonable cause, not willful neglect, $1,461 to $73,011; (iii) willful neglect, corrected within 30 days, $14,602 to $73,011; (iv) willful neglect, not corrected within 30 days, $73,011 up to the annual cap. Every tier is subject to a $2,190,294 annual cap for identical violations of the same administrative simplification provision in a calendar year.
- Rule
- Per violation only
- As of
- Minimum
- 145
- Currency
- USD
- Fixed cap
- 2,190,294
- Per violation unit
- Violation
- Per violation amount
- 2,190,294
Who enforces it
Enforcement body
HHS Office for Civil Rights
Enforcement record
Counts resolution agreements and civil money penalties HHS OCR's own published Resolution Agreements list dates to calendar year 2025 (25 actions), the latest complete calendar year the list covers, up from 14 in 2024; 5 more had posted for 2026 by the list's last review date of . OCR's separate Enforcement Highlights page states a cumulative program total, as of , of 152 settlements or civil money penalties totaling $144,878,972 since the Privacy Rule's 2003 compliance date; that cumulative total is not used here because it predates the 2025 and 2026 actions counted above and the two pages are not reconciled to a single running total. No per-case fine amounts are aggregated into a fines total here.
- As of
- Trend
- Rising
- Source link
- https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
- Actions per year
- 25
Settledness
- As of
- Guidance link
- https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- Guidance body
- HHS Office for Civil Rights
- Open questions
- Is a business associate an "agent" of the covered entity under the federal common law of agency, so that the business associate's discovery of a breach starts the covered entity's notification period under the breach-discovery rule in Subpart D of 45 CFR Part 164?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Actor identity
Log retention
Applies through 45 CFR 164.414(a), which makes 164.530(j) apply to the breach notification Subpart.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
A covered entity must keep a log or other documentation of each breach affecting fewer than 500 individuals and report those breaches to the Secretary within 60 days after the end of the calendar year. Section 164.414(a) makes the documentation and six-year retention rules of 164.530(j) apply to the Subpart, and 164.414(b) puts on the covered entity or business associate the burden of demonstrating that all notifications were made or that the use or disclosure was not a breach. Where a law enforcement official delays notice orally, the entity must document the statement, including the official's identity. The log's contents are not listed beyond that. No audit of the record is stated: the Secretary receives the notice, and the burden of proof arises in a proceeding. The Subpart states no territorial hook.
- Kind
- Explicit
- As of
- Provision
- 45 CFR 164.408(c) (a log or other documentation of breaches affecting fewer than 500 individuals); 164.414(a) and (b) (the administrative requirements of 164.530(j) apply, and the entity bears the burden of demonstrating that every notification was made); 164.412(b) (documenting an oral law enforcement statement)
- Trigger
- security_incident
What this law does
Requires a covered entity to notify each affected individual, and in some cases HHS and the media, following discovery of a breach of unsecured protected health information, without unreasonable delay and no later than 60 calendar days after discovery. First effective under a 2009 interim final rule; the 2013 Health Insurance Portability and Accountability Act (HIPAA) Omnibus Rule finalized these requirements with a general compliance date of .
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .