HIPAA Breach Notification Rule: Who, When, and How | Osto<\/title>\n<meta name=\"description\" content=\"The HIPAA Breach Notification Rule explained: what counts as a breach, the 4-factor risk assessment, the 60-day deadline, and who you must notify.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The HIPAA Breach Notification Rule decides what you must do when protected health information is exposed. Here is what counts as a breach, who to tell, and how fast.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The Breach Notification Rule requires you to notify affected individuals, HHS, and sometimes the media when unsecured protected health information is exposed. Individuals must be told without unreasonable delay and no later than 60 days after discovery.<\/p>\n <p>Not every incident is a reportable breach: a four-factor risk assessment decides. And only unsecured PHI triggers notice, encrypted data generally does not. Business associates must alert the covered entity so it can notify.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What counts as a breach<\/a><\/li>\n <li><a href=\"#assess\">The 4-factor assessment<\/a><\/li>\n <li><a href=\"#who\">Who you must notify<\/a><\/li>\n <li><a href=\"#when\">The deadlines<\/a><\/li>\n <li><a href=\"#ba\">Business associates<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What counts as a HIPAA breach?<\/h2>\n <p>A breach is an impermissible use or disclosure of <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\/\">protected health information<\/a> that compromises its security or privacy. The key qualifier is unsecured: the Breach Notification Rule applies to unsecured PHI, meaning data that has not been rendered unreadable, such as through encryption. If exposed data was properly encrypted, notification is generally not required, which is one reason encryption matters so much.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Why encryption changes everything here<\/div>Notification obligations attach to unsecured PHI. Encrypted health data that is exposed generally does not trigger the breach notification requirements, because it is not readable. Strong encryption is both a safeguard and a shield against notification burden.<\/div>\n\n <h2 class=\"sec\" id=\"assess\">The four-factor risk assessment<\/h2>\n <p>An impermissible use or disclosure is presumed to be a breach, but you can rebut that presumption. You do so with a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> that weighs whether there is a low probability the PHI was compromised. If four factors together show low probability, notification may not be required, and you document that conclusion.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Is it a reportable breach?<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Not every incident triggers notification<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">An impermissible use or disclosure of unsecured PHI is presumed a breach unless a risk assessment shows a low probability that the data was compromised.<\/div>\n <svg viewBox=\"0 0 700 260\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Decision flow for whether a HIPAA incident is a reportable breach\">\n<defs><marker id=\"bnArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\">\n <rect x=\"250\" y=\"14\" width=\"200\" height=\"52\" rx=\"12\" fill=\"#1c267a\"\/>\n <text x=\"350\" y=\"38\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"13\" font-weight=\"800\">Impermissible use<\/text>\n <text x=\"350\" y=\"55\" text-anchor=\"middle\" fill=\"#c3c9ee\" font-size=\"11\">or disclosure of PHI<\/text>\n <line x1=\"350\" y1=\"66\" x2=\"350\" y2=\"92\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#bnArr)\"\/>\n <rect x=\"235\" y=\"96\" width=\"230\" height=\"52\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"350\" y=\"118\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"800\">Run the 4-factor risk assessment<\/text>\n <text x=\"350\" y=\"136\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">is there a low probability of compromise?<\/text>\n \n <line x1=\"350\" y1=\"148\" x2=\"350\" y2=\"168\" stroke=\"#5b64c8\" stroke-width=\"2\"\/>\n <line x1=\"180\" y1=\"168\" x2=\"520\" y2=\"168\" stroke=\"#5b64c8\" stroke-width=\"2\"\/>\n <line x1=\"180\" y1=\"168\" x2=\"180\" y2=\"188\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#bnArr)\"\/>\n <line x1=\"520\" y1=\"168\" x2=\"520\" y2=\"188\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#bnArr)\"\/>\n <rect x=\"70\" y=\"192\" width=\"220\" height=\"56\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"180\" y=\"214\" text-anchor=\"middle\" fill=\"#0a7d6c\" font-size=\"12.5\" font-weight=\"800\">Low probability<\/text>\n <text x=\"180\" y=\"233\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Document it. No notice required.<\/text>\n <rect x=\"410\" y=\"192\" width=\"220\" height=\"56\" rx=\"12\" fill=\"#f6efff\" stroke=\"#6d3bd0\" stroke-width=\"0\" style=\"display:none\"\/>\n <rect x=\"410\" y=\"192\" width=\"220\" height=\"56\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"1.8\"\/>\n <text x=\"520\" y=\"214\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\">Reportable breach<\/text>\n <text x=\"520\" y=\"233\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Notify per the timelines below.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>The four factors are: the nature and extent of the PHI involved, who received or accessed it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. Together they determine whether the incident crosses into reportable-breach territory.<\/p>\n\n <h2 class=\"sec\" id=\"who\">Who you must notify<\/h2>\n <p>When an incident is a reportable breach, the rule can require up to three separate notifications, depending on scale.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">Who you must notify<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">A breach can trigger up to three notifications<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Affected individuals<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Without unreasonable delay, and no later than 60 days after discovery.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><rect x=\"5\" y=\"3\" width=\"14\" height=\"18\" rx=\"1\"\/><path d=\"M9 7h2M13 7h2M9 11h2M13 11h2M9 15h2M13 15h2\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">HHS (OCR)<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Within 60 days for large breaches; annually for smaller ones.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M4 10v4a1 1 0 0 0 1 1h2l3.5 3.5V5.5L7 9H5a1 1 0 0 0-1 1z\"\/><path d=\"M15 8.5a4 4 0 0 1 0 7\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The media<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Required when 500+ residents of one state or jurisdiction are affected.<\/div>\n <\/div><\/div>\n<\/div>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Recipient<\/th><th>When<\/th><th>Deadline<\/th><\/tr>\n <tr><td><strong>Affected individuals<\/strong><\/td><td>Every reportable breach<\/td><td>Without unreasonable delay, within 60 days of discovery<\/td><\/tr>\n <tr><td><strong>HHS (large breach)<\/strong><\/td><td>500 or more individuals<\/td><td>Within 60 days of discovery<\/td><\/tr>\n <tr><td><strong>HHS (small breach)<\/strong><\/td><td>Fewer than 500 individuals<\/td><td>Within 60 days after the calendar year ends<\/td><\/tr>\n <tr><td><strong>The media<\/strong><\/td><td>500+ residents of one state or jurisdiction<\/td><td>Without unreasonable delay, within 60 days<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"when\">The deadlines, on a timeline<\/h2>\n <p>The headline number is 60 days, but exactly what that 60 days is measured from depends on the size of the breach.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The deadlines<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">The 60-day clock, and the exception<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Large breaches are reported to individuals and HHS within 60 days. Smaller ones can be logged and reported after the calendar year.<\/div>\n <svg viewBox=\"0 0 720 130\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"HIPAA breach notification timeline of deadlines\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <line x1=\"60\" y1=\"70\" x2=\"660\" y2=\"70\" stroke=\"#d7dcf2\" stroke-width=\"3\"\/>\n <g text-anchor=\"middle\">\n <circle cx=\"120\" cy=\"70\" r=\"9\" fill=\"#1c267a\"\/><circle cx=\"360\" cy=\"70\" r=\"9\" fill=\"#2b3596\"\/><circle cx=\"600\" cy=\"70\" r=\"9\" fill=\"#3a46c0\"\/>\n <\/g>\n <g text-anchor=\"middle\" font-size=\"12.5\" font-weight=\"800\" fill=\"#0e1330\">\n <text x=\"120\" y=\"40\">Discovery<\/text><text x=\"360\" y=\"40\">Individuals + HHS<\/text><text x=\"600\" y=\"40\">Smaller breaches<\/text>\n <\/g>\n <g text-anchor=\"middle\" font-size=\"11\" fill=\"#5b6178\">\n <text x=\"120\" y=\"102\">day 0<\/text>\n <text x=\"360\" y=\"102\">within 60 days<\/text><text x=\"360\" y=\"118\">(500+ individuals)<\/text>\n <text x=\"600\" y=\"102\">60 days after<\/text><text x=\"600\" y=\"118\">year-end (under 500)<\/text>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The public dimension<\/div>Breaches affecting 500 or more individuals are posted on the public HHS breach portal. Beyond the legal deadlines, that visibility is why breach handling is also a matter of trust and reputation, not just compliance.<\/div>\n\n <h2 class=\"sec\" id=\"ba\">What business associates must do<\/h2>\n <p>If you are a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/\">business associate<\/a>, a SaaS vendor, cloud host, or processor handling PHI, and you discover a breach, your primary duty is to notify the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/covered-entity\/\">covered entity<\/a> without unreasonable delay and within 60 days, providing the information it needs to notify individuals, HHS, and the media. Your business associate agreement should spell out exactly how and how fast you will do this, so agree it in advance.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to breach readiness<\/h2>\n <p>Breach readiness is not just about reacting fast. It is about the controls that prevent breaches, detect them early, and, through <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, reduce which incidents even become reportable, plus the evidence trail regulators expect if they investigate. Running that across scattered tools is where detection lags and the evidence trail fragments.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Encryption, access control, audit logging, and monitoring run on one platform and produce evidence automatically, so breaches are less likely, detected sooner, and often kept out of reportable territory through encryption, with a timestamped evidence trail ready if OCR asks. That is why lean teams treat Osto as the default foundation for breach readiness.<\/div>\n\n <div class=\"callout\">\n <h3>Be ready before a breach, not scrambling after.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Encrypt PHI, detect incidents early, and keep the evidence trail, all on one platform mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the HIPAA Breach Notification Rule?<\/summary><p>It requires covered entities and business associates to notify affected individuals, HHS, and sometimes the media when unsecured protected health information is breached. Individuals must be notified without unreasonable delay and no later than 60 days after discovery.<\/p><\/details>\n <details><summary>What is the HIPAA breach notification deadline?<\/summary><p>Individuals and, for breaches of 500 or more, HHS must be notified within 60 days of discovery. Breaches affecting fewer than 500 individuals can be logged and reported to HHS within 60 days after the end of the calendar year.<\/p><\/details>\n <details><summary>Does every incident require notification?<\/summary><p>No. An impermissible use or disclosure is presumed a breach, but a four-factor risk assessment can show a low probability that PHI was compromised, in which case notification may not be required. You document that determination.<\/p><\/details>\n <details><summary>Does encryption affect breach notification?<\/summary><p>Yes, significantly. The rule applies to unsecured PHI. If exposed data was properly encrypted and therefore unreadable, notification is generally not required. Encryption both protects data and reduces notification burden.<\/p><\/details>\n <details><summary>When is media notification required?<\/summary><p>When a breach affects 500 or more residents of a single state or jurisdiction. The covered entity must notify prominent media outlets serving that area without unreasonable delay and no later than 60 days after discovery.<\/p><\/details>\n <details><summary>What must a business associate do after a breach?<\/summary><p>Notify the covered entity without unreasonable delay and within 60 days, providing the details it needs to notify individuals, HHS, and the media. The specific responsibilities and timing should be defined in the business associate agreement.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA Breach Notification Rule: Who, When, and How | Osto The HIPAA Breach Notification Rule decides what you must do\u2026<\/p>\n","protected":false},"author":8,"featured_media":869,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[352,353,337],"class_list":["post-868","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-breach-notification-2","tag-hipaa-breach-notification-requirements","tag-hipaa-breach-notification-rule"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=868"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/868\/revisions"}],"predecessor-version":[{"id":870,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/868\/revisions\/870"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/869"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":868,"date":"2026-08-17T06:18:05","date_gmt":"2026-08-17T06:18:05","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=868"},"modified":"2026-08-17T06:18:05","modified_gmt":"2026-08-17T06:18:05","slug":"hipaa-breach-notification-rule-2","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-breach-notification-rule-2\/","title":{"rendered":"HIPAA Breach Notification Rule: Who, When, and How"},"content":{"rendered":"\n\n\n\n\n\nHIPAA Breach Notification Rule: Who, When, and How | Osto<\/title>\n<meta name=\"description\" content=\"The HIPAA Breach Notification Rule explained: what counts as a breach, the 4-factor risk assessment, the 60-day deadline, and who you must notify.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The HIPAA Breach Notification Rule decides what you must do when protected health information is exposed. Here is what counts as a breach, who to tell, and how fast.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The Breach Notification Rule requires you to notify affected individuals, HHS, and sometimes the media when unsecured protected health information is exposed. Individuals must be told without unreasonable delay and no later than 60 days after discovery.<\/p>\n <p>Not every incident is a reportable breach: a four-factor risk assessment decides. And only unsecured PHI triggers notice, encrypted data generally does not. Business associates must alert the covered entity so it can notify.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What counts as a breach<\/a><\/li>\n <li><a href=\"#assess\">The 4-factor assessment<\/a><\/li>\n <li><a href=\"#who\">Who you must notify<\/a><\/li>\n <li><a href=\"#when\">The deadlines<\/a><\/li>\n <li><a href=\"#ba\">Business associates<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What counts as a HIPAA breach?<\/h2>\n <p>A breach is an impermissible use or disclosure of <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\/\">protected health information<\/a> that compromises its security or privacy. The key qualifier is unsecured: the Breach Notification Rule applies to unsecured PHI, meaning data that has not been rendered unreadable, such as through encryption. If exposed data was properly encrypted, notification is generally not required, which is one reason encryption matters so much.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Why encryption changes everything here<\/div>Notification obligations attach to unsecured PHI. Encrypted health data that is exposed generally does not trigger the breach notification requirements, because it is not readable. Strong encryption is both a safeguard and a shield against notification burden.<\/div>\n\n <h2 class=\"sec\" id=\"assess\">The four-factor risk assessment<\/h2>\n <p>An impermissible use or disclosure is presumed to be a breach, but you can rebut that presumption. You do so with a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk assessment<\/a> that weighs whether there is a low probability the PHI was compromised. If four factors together show low probability, notification may not be required, and you document that conclusion.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Is it a reportable breach?<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Not every incident triggers notification<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">An impermissible use or disclosure of unsecured PHI is presumed a breach unless a risk assessment shows a low probability that the data was compromised.<\/div>\n <svg viewBox=\"0 0 700 260\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Decision flow for whether a HIPAA incident is a reportable breach\">\n<defs><marker id=\"bnArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\">\n <rect x=\"250\" y=\"14\" width=\"200\" height=\"52\" rx=\"12\" fill=\"#1c267a\"\/>\n <text x=\"350\" y=\"38\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"13\" font-weight=\"800\">Impermissible use<\/text>\n <text x=\"350\" y=\"55\" text-anchor=\"middle\" fill=\"#c3c9ee\" font-size=\"11\">or disclosure of PHI<\/text>\n <line x1=\"350\" y1=\"66\" x2=\"350\" y2=\"92\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#bnArr)\"\/>\n <rect x=\"235\" y=\"96\" width=\"230\" height=\"52\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"350\" y=\"118\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"12.5\" font-weight=\"800\">Run the 4-factor risk assessment<\/text>\n <text x=\"350\" y=\"136\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">is there a low probability of compromise?<\/text>\n \n <line x1=\"350\" y1=\"148\" x2=\"350\" y2=\"168\" stroke=\"#5b64c8\" stroke-width=\"2\"\/>\n <line x1=\"180\" y1=\"168\" x2=\"520\" y2=\"168\" stroke=\"#5b64c8\" stroke-width=\"2\"\/>\n <line x1=\"180\" y1=\"168\" x2=\"180\" y2=\"188\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#bnArr)\"\/>\n <line x1=\"520\" y1=\"168\" x2=\"520\" y2=\"188\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#bnArr)\"\/>\n <rect x=\"70\" y=\"192\" width=\"220\" height=\"56\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"180\" y=\"214\" text-anchor=\"middle\" fill=\"#0a7d6c\" font-size=\"12.5\" font-weight=\"800\">Low probability<\/text>\n <text x=\"180\" y=\"233\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Document it. No notice required.<\/text>\n <rect x=\"410\" y=\"192\" width=\"220\" height=\"56\" rx=\"12\" fill=\"#f6efff\" stroke=\"#6d3bd0\" stroke-width=\"0\" style=\"display:none\"\/>\n <rect x=\"410\" y=\"192\" width=\"220\" height=\"56\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"1.8\"\/>\n <text x=\"520\" y=\"214\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"12.5\" font-weight=\"800\">Reportable breach<\/text>\n <text x=\"520\" y=\"233\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Notify per the timelines below.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>The four factors are: the nature and extent of the PHI involved, who received or accessed it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. Together they determine whether the incident crosses into reportable-breach territory.<\/p>\n\n <h2 class=\"sec\" id=\"who\">Who you must notify<\/h2>\n <p>When an incident is a reportable breach, the rule can require up to three separate notifications, depending on scale.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">Who you must notify<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">A breach can trigger up to three notifications<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Affected individuals<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Without unreasonable delay, and no later than 60 days after discovery.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><rect x=\"5\" y=\"3\" width=\"14\" height=\"18\" rx=\"1\"\/><path d=\"M9 7h2M13 7h2M9 11h2M13 11h2M9 15h2M13 15h2\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">HHS (OCR)<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Within 60 days for large breaches; annually for smaller ones.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M4 10v4a1 1 0 0 0 1 1h2l3.5 3.5V5.5L7 9H5a1 1 0 0 0-1 1z\"\/><path d=\"M15 8.5a4 4 0 0 1 0 7\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The media<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Required when 500+ residents of one state or jurisdiction are affected.<\/div>\n <\/div><\/div>\n<\/div>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Recipient<\/th><th>When<\/th><th>Deadline<\/th><\/tr>\n <tr><td><strong>Affected individuals<\/strong><\/td><td>Every reportable breach<\/td><td>Without unreasonable delay, within 60 days of discovery<\/td><\/tr>\n <tr><td><strong>HHS (large breach)<\/strong><\/td><td>500 or more individuals<\/td><td>Within 60 days of discovery<\/td><\/tr>\n <tr><td><strong>HHS (small breach)<\/strong><\/td><td>Fewer than 500 individuals<\/td><td>Within 60 days after the calendar year ends<\/td><\/tr>\n <tr><td><strong>The media<\/strong><\/td><td>500+ residents of one state or jurisdiction<\/td><td>Without unreasonable delay, within 60 days<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"when\">The deadlines, on a timeline<\/h2>\n <p>The headline number is 60 days, but exactly what that 60 days is measured from depends on the size of the breach.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The deadlines<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">The 60-day clock, and the exception<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Large breaches are reported to individuals and HHS within 60 days. Smaller ones can be logged and reported after the calendar year.<\/div>\n <svg viewBox=\"0 0 720 130\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"HIPAA breach notification timeline of deadlines\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <line x1=\"60\" y1=\"70\" x2=\"660\" y2=\"70\" stroke=\"#d7dcf2\" stroke-width=\"3\"\/>\n <g text-anchor=\"middle\">\n <circle cx=\"120\" cy=\"70\" r=\"9\" fill=\"#1c267a\"\/><circle cx=\"360\" cy=\"70\" r=\"9\" fill=\"#2b3596\"\/><circle cx=\"600\" cy=\"70\" r=\"9\" fill=\"#3a46c0\"\/>\n <\/g>\n <g text-anchor=\"middle\" font-size=\"12.5\" font-weight=\"800\" fill=\"#0e1330\">\n <text x=\"120\" y=\"40\">Discovery<\/text><text x=\"360\" y=\"40\">Individuals + HHS<\/text><text x=\"600\" y=\"40\">Smaller breaches<\/text>\n <\/g>\n <g text-anchor=\"middle\" font-size=\"11\" fill=\"#5b6178\">\n <text x=\"120\" y=\"102\">day 0<\/text>\n <text x=\"360\" y=\"102\">within 60 days<\/text><text x=\"360\" y=\"118\">(500+ individuals)<\/text>\n <text x=\"600\" y=\"102\">60 days after<\/text><text x=\"600\" y=\"118\">year-end (under 500)<\/text>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The public dimension<\/div>Breaches affecting 500 or more individuals are posted on the public HHS breach portal. Beyond the legal deadlines, that visibility is why breach handling is also a matter of trust and reputation, not just compliance.<\/div>\n\n <h2 class=\"sec\" id=\"ba\">What business associates must do<\/h2>\n <p>If you are a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/\">business associate<\/a>, a SaaS vendor, cloud host, or processor handling PHI, and you discover a breach, your primary duty is to notify the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/covered-entity\/\">covered entity<\/a> without unreasonable delay and within 60 days, providing the information it needs to notify individuals, HHS, and the media. Your business associate agreement should spell out exactly how and how fast you will do this, so agree it in advance.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to breach readiness<\/h2>\n <p>Breach readiness is not just about reacting fast. It is about the controls that prevent breaches, detect them early, and, through <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, reduce which incidents even become reportable, plus the evidence trail regulators expect if they investigate. Running that across scattered tools is where detection lags and the evidence trail fragments.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Encryption, access control, audit logging, and monitoring run on one platform and produce evidence automatically, so breaches are less likely, detected sooner, and often kept out of reportable territory through encryption, with a timestamped evidence trail ready if OCR asks. That is why lean teams treat Osto as the default foundation for breach readiness.<\/div>\n\n <div class=\"callout\">\n <h3>Be ready before a breach, not scrambling after.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Encrypt PHI, detect incidents early, and keep the evidence trail, all on one platform mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the HIPAA Breach Notification Rule?<\/summary><p>It requires covered entities and business associates to notify affected individuals, HHS, and sometimes the media when unsecured protected health information is breached. Individuals must be notified without unreasonable delay and no later than 60 days after discovery.<\/p><\/details>\n <details><summary>What is the HIPAA breach notification deadline?<\/summary><p>Individuals and, for breaches of 500 or more, HHS must be notified within 60 days of discovery. Breaches affecting fewer than 500 individuals can be logged and reported to HHS within 60 days after the end of the calendar year.<\/p><\/details>\n <details><summary>Does every incident require notification?<\/summary><p>No. An impermissible use or disclosure is presumed a breach, but a four-factor risk assessment can show a low probability that PHI was compromised, in which case notification may not be required. You document that determination.<\/p><\/details>\n <details><summary>Does encryption affect breach notification?<\/summary><p>Yes, significantly. The rule applies to unsecured PHI. If exposed data was properly encrypted and therefore unreadable, notification is generally not required. Encryption both protects data and reduces notification burden.<\/p><\/details>\n <details><summary>When is media notification required?<\/summary><p>When a breach affects 500 or more residents of a single state or jurisdiction. The covered entity must notify prominent media outlets serving that area without unreasonable delay and no later than 60 days after discovery.<\/p><\/details>\n <details><summary>What must a business associate do after a breach?<\/summary><p>Notify the covered entity without unreasonable delay and within 60 days, providing the details it needs to notify individuals, HHS, and the media. The specific responsibilities and timing should be defined in the business associate agreement.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA Breach Notification Rule: Who, When, and How | Osto The HIPAA Breach Notification Rule decides what you must do\u2026<\/p>\n","protected":false},"author":8,"featured_media":869,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[352,353,337],"class_list":["post-868","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-breach-notification-2","tag-hipaa-breach-notification-requirements","tag-hipaa-breach-notification-rule"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=868"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/868\/revisions"}],"predecessor-version":[{"id":870,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/868\/revisions\/870"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/869"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}