HIPAA breach notification for practices: who to notify, when, and what the patient letter must say

Most practice owners hope they never need this page. When they do, it is usually because something specific happened: a laptop went missing, an email with patient details went to the wrong list, a vendor reported an incident, or a form on the website sent more than it should have. The days that follow are busy, and the federal rules on who must be told, by when and in what words are more specific than many people expect.

This guide covers the HIPAA Breach Notification Rule as it applies to a practice that is a covered entity: what counts as a breach, the risk assessment, the notice to patients, the website and media notices, the report to HHS, what a business associate owes you, and the patient communication mistakes to avoid. If part of your business sits outside HIPAA, such as a consumer app, read our guide to the FTC Health Breach Notification Rule as well.

What counts as a breach

The rule is in 45 CFR 164.400 to 164.414. Under 45 CFR 164.402, a breach is the acquisition, access, use or disclosure of protected health information in a manner the Privacy Rule does not permit, which compromises the security or privacy of that information. The notice duties apply to breaches of unsecured protected health information.

The important part is the presumption. Under the same section, an impermissible acquisition, access, use or disclosure is presumed to be a breach unless the covered entity or business associate shows a low probability that the information has been compromised, based on a risk assessment of at least four factors.

1. The information involved.Its nature and extent, including the types of identifiers and the likelihood of re-identification.
2. Who received it.The unauthorized person who used the information or to whom it was disclosed.
3. Whether it was seen.Whether the information was actually acquired or viewed.
4. Mitigation.The extent to which the risk to the information has been mitigated.

The HHS Breach Notification Rule page adds that covered entities and business associates have discretion to give the required notices without doing a risk assessment. In other words, you can decide to notify. What you cannot do is decide not to notify without being able to show the low probability.

The three exceptions

Section 164.402 excludes three situations from the definition of breach.

• Good faith access by staff. An unintentional acquisition, access or use by a workforce member or person acting under your authority, made in good faith and within the scope of their authority, that does not lead to a further impermissible use or disclosure.
• Inadvertent disclosure inside the practice. An inadvertent disclosure by a person authorized to access protected health information to another authorized person at the same covered entity or business associate, or in an organized health care arrangement you participate in, where the information is not further used or disclosed improperly.
• Information that could not be kept. A disclosure where you have a good faith belief that the unauthorized recipient would not reasonably have been able to retain the information.

These are narrow. A front desk employee opening the wrong chart by mistake may fit the first. An employee browsing a neighbor’s chart out of curiosity is unlikely to fit, because that access is neither in good faith nor within the scope of their job.

Secured information: encryption and destruction

The notice duties apply only to unsecured protected health information. Under 45 CFR 164.402, that means information not rendered unusable, unreadable or indecipherable to unauthorized persons through a technology or methodology the Secretary specifies in guidance. The HHS guidance names two: encryption that meets the Security Rule standard, where the key or process that could decrypt it has not also been breached, and destruction of the media. It points to NIST publications for encryption of data at rest and in motion and for media sanitization, and it says redaction is not a means of destruction for paper records.

For a practice, this is the most practical lesson in the whole rule. A lost laptop or phone with properly encrypted storage, where the key was not lost with it, is a very different event from a lost device without encryption. Our guide to practice website hosting and HIPAA covers encryption questions for the website side.

When the clock starts

Under 45 CFR 164.404(a)(2), a breach is treated as discovered on the first day it is known to the covered entity or, by exercising reasonable diligence, would have been known. The practice is treated as knowing about a breach if any workforce member or agent other than the person who committed it knows or should have known.

That second sentence matters for small practices. If a staff member knew about a misdirected fax on Monday and the owner hears about it on Friday, the clock may already have been running since Monday. A clear internal rule that staff report possible privacy incidents the same day protects the practice as much as the patients.

Notice to patients

Under 45 CFR 164.404(b), the notice to each affected individual must go out without unreasonable delay and in no case later than 60 calendar days after discovery. Sixty days is an outer limit, not a target. If you could reasonably have sent notice sooner, waiting for the deadline can itself be a problem.

What the letter must include

Section 164.404(c) lists the content. The notice must include, to the extent possible, the following elements, and it must be written in plain language.

1. What happened.A brief description, including the date of the breach and the date of discovery, if known.
2. What information was involved.The types of unsecured protected health information, such as full name, Social Security number, date of birth, home address, account number, diagnosis or disability code.
3. What patients can do.Any steps individuals should take to protect themselves from potential harm.
4. What the practice is doing.A brief description of how you are investigating, mitigating harm and protecting against further breaches.
5. How to reach you.Contact procedures, which must include a toll free telephone number, an email address, a website or a postal address.

Plain language is a legal requirement here, not a style choice. Write the letter so a patient who has never heard the word “PHI” can understand what happened to their information and what to do next.

How it must be delivered

Under 45 CFR 164.404(d)(1), written notice goes by first class mail to the patient’s last known address. Email is allowed only if the patient has agreed to electronic notice and has not withdrawn that agreement. The notice may go out in more than one mailing as information becomes available. If you know the patient has died and you have the address of the next of kin or personal representative, the written notice goes to them by first class mail.

Under 45 CFR 164.404(d)(3), when you consider a situation urgent because of possible imminent misuse, you may also contact patients by telephone or other means. That is in addition to the written notice, not instead of it. A text message or patient portal post on its own does not replace the letter.

Substitute notice and your website home page

Sometimes the practice does not have current contact details for everyone affected. Section 164.404(d)(2) sets out substitute notice.

• Fewer than 10 people with bad contact details. Substitute notice may be an alternative written notice, a telephone call or other means.
• 10 or more people with bad contact details. Substitute notice must be either a conspicuous posting on the home page of your website for 90 days or a conspicuous notice in major print or broadcast media where the affected people likely live. It must include a toll free number, active for at least 90 days, where people can find out whether their information may be included.

This is one place where the website itself becomes part of compliance. Before anything goes wrong, it helps to know who can publish to your home page, how a notice would appear on phones as well as desktops, and whether it would stay visible for 90 days through any redesign or theme change. A small link in the footer is unlikely to read as conspicuous. Our medical practice website checklist is a good place to add that question.

Notice to the media

Under 45 CFR 164.406, if a breach involves more than 500 residents of a State or jurisdiction, the covered entity must also notify prominent media outlets serving that State or jurisdiction. The same 60 calendar day outer limit applies, and the content must meet the same requirements as the patient letter in 164.404(c). The HHS page says covered entities will likely do this in the form of a press release.

The count is per State or jurisdiction. A practice near a state line could have more than 500 affected people in total without crossing the media threshold in either state, or could cross it in one state and not the other. Counsel should confirm the count.

Reporting to HHS

Under 45 CFR 164.408, every breach of unsecured protected health information is reported to the Secretary of HHS. The timing depends on the size.

• 500 or more individuals. Report at the same time as the patient notice, so without unreasonable delay and no later than 60 calendar days after discovery, using the online form on the HHS website.
• Fewer than 500 individuals. Keep a log or other record of these breaches and report each breach discovered during a calendar year no later than 60 days after the end of that year. The HHS reporting page says you do not have to wait until the end of the year and may report as soon as a breach is discovered.

The HHS reporting page adds several practical points. Reports go through the OCR online breach portal. If you are unsure how many people are affected, you should give an estimate. You can file an addendum later with the transaction number from the first report. Each breach needs its own notice, even if you report several on the same day. HHS also publishes a list of breaches affecting 500 or more individuals.

The same HHS page explains that programs covered by the federal substance use disorder confidentiality rules in 42 CFR Part 2 have their own breach reporting duty for Part 2 records. If your practice runs such a program, ask counsel how both rules apply.

When the breach happens at a vendor

Under 45 CFR 164.410, a business associate that discovers a breach of unsecured protected health information must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. To the extent possible, it must identify each affected individual and give you the other information you need for the patient letter, at the time of notice or promptly after.

The HHS Breach Notification Rule page says the covered entity remains ultimately responsible for making sure individuals are notified, although it may delegate the patient notices to the business associate. Who sends the letters, and how quickly the vendor must tell you about an incident, are worth settling in the business associate agreement before anything happens. Our guide to BAAs for marketing agencies covers what that agreement must contain.

If law enforcement asks you to wait

Section 164.412 covers a law enforcement delay. If an official says a notice or posting would impede a criminal investigation or damage national security, and the statement is in writing with a time period, you delay for that period. If the statement is oral, you document it, including the identity of the official, and delay no longer than 30 days from the oral statement unless a written statement arrives within that time.

Keep the paper trail

Under 45 CFR 164.414(b), when a use or disclosure violates the Privacy Rule, the covered entity or business associate has the burden of showing either that all required notices were made or that the event was not a breach. Section 164.530(j) requires documentation sufficient to meet that burden, kept for six years from the date it was created or last in effect, whichever is later.

In practice, that means the risk assessment, the dates of discovery and of each notice, copies of the letters, the media notice if any, the HHS submission and any law enforcement statement belong in one file. A decision that an incident was not a breach needs its written reasoning just as much as a notice does.

Patient communications: what to avoid

The rule sets the minimum content. How a practice handles the rest of its communications in the same weeks also matters to patients. The points below are practical cautions, not legal rules.

• Leaving scheduled marketing running. A cheerful promotional email arriving the same week as a breach letter reads badly. Check what your email, text and social calendars will send in the coming weeks.
• Softening the facts. The letter has to describe what happened and what information was involved. Vague wording that hides the types of information involved works against the plain language requirement and against patient trust.
• Putting promotional content in the notice. Keep the breach letter about the breach. Offers or service announcements do not belong in it.
• Replying to public reviews with details. If patients post about the breach, a reply that confirms someone is a patient or discusses their information can create a new problem. See our guide to replying to negative reviews.
• Letting staff improvise. Give the front desk and anyone answering the phone a short, accurate script and a person to refer questions to.
• Assuming email is fine. The written notice goes by first class mail unless the patient agreed to electronic notice.

Illustration: a misdirected email

Illustration. A staff member sends an appointment spreadsheet to an outside email address by mistake. They tell the practice manager the same afternoon. The practice records the discovery date, asks the recipient to confirm deletion, and works through the four risk factors with counsel: what the spreadsheet held, who received it, whether it was opened, and what mitigation is possible. Counsel concludes the practice cannot show a low probability of compromise. The practice mails plain language letters to each affected patient well within 60 days, sets up a contact line for questions, pauses a promotional email planned for the same week, logs the breach, and reports it to HHS. Because fewer than 500 people were affected, the report can be filed at any time up to 60 days after the end of the calendar year.

Getting ready before anything happens

• Write a one page incident procedure: who staff tell, how fast, and who calls counsel.
• Check that laptops, phones and backups holding patient information are encrypted, and that keys are kept separately.
• Know who can post a conspicuous notice on your website home page and how it would look on a phone.
• Settle in each business associate agreement how quickly the vendor must report an incident and who sends patient letters.
• Keep a breach log template ready for incidents affecting fewer than 500 people.
• Review which marketing messages are scheduled to go out automatically, so they can be paused quickly.
• Ask counsel which state breach laws apply where your patients live.

State breach laws can set shorter deadlines and extra notices to the attorney general. Our guide to state data breach laws vs HIPAA explains how the two layers fit together.

How we help

We are a marketing studio, not a law firm or a breach response service, so we do not decide whether an incident is a breach or write your legal notice. We can make the website side easier. Our medical website design work keeps intake forms free of advertising tags, and the site lives on your domain so your practice controls its own home page. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not promise rankings, leads or results.

Frequently asked questions

Sources

• 45 CFR 164.402: Definitions (breach, unsecured protected health information)
• 45 CFR 164.404: Notification to individuals
• 45 CFR 164.406: Notification to the media
• 45 CFR 164.408: Notification to the Secretary
• 45 CFR 164.410: Notification by a business associate
• 45 CFR 164.412: Law enforcement delay
• 45 CFR 164.414: Administrative requirements and burden of proof
• 45 CFR 164.530: Administrative requirements (documentation and retention)
• HHS: Breach Notification Rule (content last reviewed July 26, 2013)
• HHS: Submitting Notice of a Breach to the Secretary (content last reviewed February 13, 2026)
• HHS: Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable (content last reviewed July 26, 2013)
• HHS OCR: Breach Portal, breaches affecting 500 or more individuals

More in Healthcare marketing rules