HIPAA Breach Notification

Notify affected individuals without unreasonable delay and no later than 60 days after discovery. Include a description of the breach, types of information involved, steps individuals should take, what the entity is doing to mitigate harm, and contact information. Breaches affecting 500 or more individuals require notification to HHS and prominent local media. Maintain a log of all breaches affecting fewer than 500 individuals for annual reporting.