Every practice owner I know has a folder somewhere labeled "if something bad happens." Most of them are empty. When a breach actually hits, the clock starts before you've finished reading the alert, and the 60-day countdown under HIPAA is not something you want to be figuring out in real time.

This is a plain-language walkthrough of what you owe patients, HHS, and sometimes the media when protected health information (PHI) is exposed. It is not legal advice. Your counsel and your compliance officer get the final word on your specific situation. But you should understand the shape of the obligation before you need to act on it.

What counts as a breach

Under the HIPAA Breach Notification Rule, a breach is the acquisition, access, use, or disclosure of PHI in a way that is not permitted by the Privacy Rule and that compromises the security or privacy of that information. The default assumption is that any impermissible use or disclosure is a breach. You have to affirmatively demonstrate a low probability that PHI was compromised, using a four-factor risk assessment, to conclude otherwise.

The four factors, in plain terms:

  • What PHI was involved, and how identifiable was it (names plus diagnoses plus SSNs is very different from a first name on a schedule).
  • Who received or accessed the information (another covered entity is different from an unknown third party).
  • Whether the PHI was actually acquired or viewed, or only potentially so.
  • The extent to which the risk has been mitigated (a signed attestation of deletion carries weight, an unreturned laptop does not).

A few situations are carve-outs and not breaches: unintentional access by a workforce member acting in good faith within their role, inadvertent disclosure between authorized people at the same entity, and disclosures where the recipient could not reasonably have retained the information. Encryption that meets HHS guidance is the big one. If the data was properly encrypted and the key was not compromised, you generally do not have a reportable breach. This is the single best insurance policy your IT stack can buy you.

The 60-day clock, and the clock inside the clock

The headline number is 60 days. From the date a breach is discovered, you have no later than 60 calendar days to notify affected individuals. "Discovered" means the first day the breach is known, or reasonably should have been known, to anyone in your workforce other than the person who caused it. A front-desk staffer noticing a misdirected fax on Tuesday starts the clock on Tuesday, not on Friday when it reaches the practice manager.

Sixty days is a ceiling, not a target. If you can notify sooner without sacrificing the accuracy of the investigation, do it. Regulators and plaintiffs' attorneys both read delay as evidence of disorganization.

Inside that 60 days you also owe:

  • HHS notification. For breaches affecting 500 or more individuals, you must notify the HHS Secretary without unreasonable delay and no later than 60 days from discovery. For breaches under 500, you log them internally and submit an annual report to HHS within 60 days after the end of the calendar year.
  • Media notification. If a breach affects more than 500 residents of a single state or jurisdiction, you must notify prominent media outlets serving that area, again within 60 days.
  • Business associate notification to you. If your billing vendor, EMR host, or any BA discovers a breach, they must notify you without unreasonable delay and no later than 60 days from their discovery. Your clock generally starts when they tell you, but your BAA can (and should) require faster notice. I push for 5 business days in every BAA I sign.

State laws often layer on top. Many states require notification faster than 60 days, sometimes as short as 30, and many have their own definitions of personal information that sweep in data HIPAA does not. If you operate in multiple states, assume the strictest rule applies until your counsel says otherwise.

What the notice to patients actually has to say

The individual notice is not a form letter you can wing. HIPAA requires plain-language content covering: a brief description of what happened, including the date of the breach and the date of discovery; the types of PHI involved (not the actual data, the categories, so "name, date of birth, diagnosis codes"); steps individuals can take to protect themselves; what your practice is doing to investigate, mitigate, and prevent recurrence; and contact information including a toll-free number, email, website, or postal address.

Notice goes by first-class mail to the last known address, or by email if the individual has agreed to electronic notice. If you have insufficient or out-of-date contact information for 10 or more individuals, you must provide substitute notice, which means a conspicuous posting on your website for 90 days or notice in major print or broadcast media, plus a toll-free number active for at least 90 days.

The first 72 hours: what actually matters

Regulators care about the 60-day letter. Your practice's survival depends on what you do in the first 72 hours.

Contain the incident

Get the affected system off the network. Rotate credentials. Preserve logs before they roll over (most EMR audit logs have a retention window, and if you overwrite the evidence you cannot reconstruct scope later). If a device is missing, initiate remote wipe if you can do it without destroying forensic value, and coordinate with your MSP or security vendor first.

Convene the response team

You should already know who this is. Owner or medical director, practice manager, privacy officer, security officer (often the same person in a small practice), outside counsel, and your cyber insurance carrier. Call the insurer early. Most policies require notice as a condition of coverage, and they usually bring in a breach coach who has done this a hundred times.

Start the risk assessment on paper

Open a document, date it, and start writing down what you know and when you knew it. This becomes your contemporaneous record. If you conclude no breach occurred, the four-factor analysis is what you show HHS. If you conclude a breach did occur, this is your timeline for the notification letter.

Where practices get themselves in trouble

The pattern I see most often is not the initial incident. It is the second-order failure. Practices discover a phishing compromise on day 3, spend three weeks arguing internally about whether it "really" counts, retain counsel on day 30, and then scramble to send letters on day 58 without a proper mailing list or a working call-in number. HHS sees the delay in the postmark and the incomplete letter and opens a compliance review.

The other pattern: no documentation. If you decide something is not a breach, you must be able to prove why. "We talked about it and thought it was fine" is not a defense. A dated four-factor assessment signed by your privacy officer is.

Build the muscle before you need it

Breach response is an operational capability, not a policy binder. The practices that handle incidents cleanly have three things in place: an incident log that anyone in the practice can add to in under 60 seconds, a written response plan with names and phone numbers (not roles), and an annual tabletop exercise where you actually walk through a fake breach and time yourselves.

The infrastructure matters too. Encrypted data at rest and in transit, granular audit logs you can actually query, role-based access that limits blast radius, and BAAs that obligate your vendors to tell you fast. If you want to see how we think about these controls in the EMR and AI-agent layer for compounding and concierge practices, talk to our team.

Frequently Asked Questions

Does a lost laptop always trigger notification?

Only if it held unsecured PHI. If the device was encrypted to HHS standards and the encryption key was not compromised, the loss generally does not require notification. Document the encryption status and the evidence supporting it.

What if a staff member accessed a record they shouldn't have?

Snooping is almost always a reportable breach. Run the four-factor assessment, but internal unauthorized access by a curious employee typically does not qualify for the good-faith carve-out. Discipline, retraining, and notification usually all apply.

Do we notify if the recipient promises to delete the information?

An attestation of destruction is a mitigation factor, not a get-out-of-jail card. It weighs in your favor in the four-factor analysis, especially if the recipient is another covered entity, but it does not automatically remove the notification obligation. Have counsel weigh in.

What triggers the 500-person threshold?

Five hundred or more individuals affected by a single breach, counted across all jurisdictions, requires immediate HHS notification and posting on the HHS "wall of shame." Five hundred or more in a single state or jurisdiction adds the media notification requirement. Under 500, you still notify individuals within 60 days but only report to HHS annually.

Who is responsible if our EMR vendor is the one breached?

Your vendor is a business associate and has direct liability under HIPAA. They must notify you, and they carry their own regulatory exposure. You still owe the notification to your patients, because your relationship is with them. This is why the notification timelines in your BAA matter as much as the security controls behind them.