Guide · HIPAA · Breach Notification

The HIPAA Breach Notification Clock: Discovery, the Four-Factor Assessment, and Every Deadline

Nearly every deadline runs from the discovery date, and the rule defines it more broadly than most organizations expect.

By Lincoln Square Law · 8-minute read

When a healthcare organization learns that patient information may have been exposed, several legal clocks start at once. Most of them run from a single date, the date the breach is discovered, and the HIPAA Breach Notification Rule defines that date more broadly than most organizations expect. A practice that waits for its investigation to finish before it starts counting can find that the sixty-day deadline has already passed. This guide explains how discovery is defined, how to decide whether an incident is a reportable breach, and every notice the federal rule and Illinois law require, with the timing for each.

When the clock starts

A breach is treated as discovered on the first day it is known to the covered entity, or the first day it would have been known by exercising reasonable diligence (45 C.F.R. 164.404(a)(2)). Knowledge of any workforce member or agent, other than the person who committed the breach, is attributed to the organization. In practice, the clock can start when a front-desk employee notices a misdirected fax or when an IT vendor sees unusual activity, not when leadership is briefed.

This is why the first hours matter. Someone must record the date and time the incident was first noticed, who noticed it, and what they saw. That record will anchor every deadline that follows, and it will be the first thing OCR asks about if the timing is ever questioned.

Is it a reportable breach?

A breach is the acquisition, access, use, or disclosure of protected health information in a manner not permitted by the Privacy Rule that compromises its security or privacy (45 C.F.R. 164.402). Three narrow exceptions exist: unintentional access by a workforce member acting in good faith within the scope of authority, inadvertent disclosure between people authorized to access PHI at the same organization, and a disclosure where the organization has a good-faith belief that the recipient could not reasonably have retained the information.

Outside those exceptions, an impermissible use or disclosure is presumed to be a breach unless the organization demonstrates a low probability that the PHI has been compromised, based on a risk assessment of at least four factors:

• The information involved, including the types of identifiers and the likelihood of re-identification.
• The unauthorized person who used the PHI or received it.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk has been mitigated, for example through a signed attestation that misdirected records were destroyed.

The assessment must be documented, and the organization bears the burden of proving either that notice was given as required or that the incident was not a breach (45 C.F.R. 164.414(b)). Documentation must be kept for six years (45 C.F.R. 164.530(j)).

One threshold question often decides the whole analysis. PHI encrypted in line with HHS guidance is not unsecured PHI, and the notification requirements apply only to breaches of unsecured PHI. A stolen laptop that was properly encrypted, with the key not compromised, usually ends the inquiry.

Notice to individuals

Affected individuals must be notified without unreasonable delay and no later than sixty calendar days after discovery (45 C.F.R. 164.404(b)). Sixty days is an outer limit, not a safe harbor. If the facts were clear on day ten, waiting until day fifty-nine can itself be unreasonable delay.

The notice must be written in plain language and include a description of what happened with the dates of the breach and of discovery, the types of information involved, the steps individuals should take to protect themselves, what the organization is doing to investigate, mitigate, and prevent recurrence, and contact procedures that include a toll-free number, email address, website, or postal address (45 C.F.R. 164.404(c)). It goes by first-class mail, or by email if the individual has agreed to electronic notice.

When contact information is out of date for fewer than ten people, substitute notice may be given by another written method, by telephone, or by other means. When it is out of date for ten or more, substitute notice must be a conspicuous posting on the organization’s website for ninety days or notice in major print or broadcast media, together with a toll-free number that stays active for at least ninety days (45 C.F.R. 164.404(d)(2)).

Notice to the media and to HHS

A breach involving more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area, on the same sixty-day schedule (45 C.F.R. 164.406).

HHS must be notified of every breach. For breaches affecting 500 or more individuals, notice goes to HHS at the same time as the notice to individuals. For breaches affecting fewer than 500, the organization keeps a log and submits notice for all of them within sixty days after the end of the calendar year in which they were discovered (45 C.F.R. 164.408). Many small breaches are therefore reported in a single filing each winter, and the log must be complete enough to support it.

Business associates

A business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and no later than sixty calendar days after discovery, identifying each affected individual to the extent possible and providing the information the covered entity will need for its own notices (45 C.F.R. 164.410). The business associate’s discovery date does not automatically become the covered entity’s. If the business associate is acting as the covered entity’s agent, however, its knowledge may be attributed to the covered entity. Business associate agreements should set a much shorter reporting period and specify what information must be delivered.

Law enforcement delay

If a law enforcement official states that notice would impede a criminal investigation or damage national security, notice must be delayed. A written statement delays notice for the period specified. An oral statement must be documented and delays notice for no more than thirty days unless a written statement follows (45 C.F.R. 164.412).

Illinois requirements

The Illinois Personal Information Protection Act has its own notice rules. A covered entity or business associate that is subject to and in compliance with the HIPAA privacy and security standards is deemed to comply with the Act, provided that any entity required to notify HHS of a breach also notifies the Illinois Attorney General within five business days of notifying HHS (815 ILCS 530/50). That five-business-day deadline is easy to miss, especially for breaches under 500 reported in the annual filing, because the Illinois notice is keyed to the date of the federal notice. Other states where affected patients live may impose their own requirements.

Building the timeline

When an incident is confirmed, write out the calendar immediately: the discovery date, day sixty for individual and media notice, the HHS notice date, the Illinois Attorney General deadline five business days after it, and any contractual deadlines owed to health plans or partners. Assign an owner to each. Then work backward to find when the forensic findings, the list of affected individuals, the mailing addresses, the call center, and the notice letters must be ready.

What to document

For every incident, reportable or not, keep a file that shows the date and manner of discovery, who investigated, the four-factor risk assessment and its conclusion, copies of every notice sent with the dates they went out, the HHS and Attorney General submissions, and any law enforcement delay request. For incidents that were not reported, the file must show why. Six years from now, that file is the only proof that the organization met its burden.

When to get advice

Get counsel involved on the day of discovery, not after the investigation. Early involvement helps preserve privilege over the forensic work, keeps the risk assessment disciplined, and makes sure the discovery date is fixed accurately before anyone has to defend it.