HIPAA Times news | Concise, reliable news and insights on HIPAA compliance and regulations

How to notify the HHS of a data breach

Written by Tshedimoso Makhene | Aug 22, 2025 12:00:00 PM

Under HIPAA’s Breach Notification Rule, the US Department of Health and Human Services (HHS) must be notified of all breaches of unsecured protected health information (PHI), regardless of size. However, “A covered entity’s breach notification obligations differ based on whether the breach affects 500 or more individuals or fewer than 500 individuals.” Understanding the obligations a covered entity or business associate, HIPAA-regulated entities, has when a breach occurs helps these HIPAA-regulated entities know what to do and when. 

 

What is a breach under HIPAA?

The HHS defines a HIPAA breach as “an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information.” This includes situations where PHI is lost or stolen, accessed by an unauthorized person, or inadvertently disclosed. Determining whether a breach has occurred involves a risk assessment to evaluate the likelihood that PHI has been compromised. This assessment considers factors such as the nature and extent of the PHI involved, the unauthorized person who accessed the information, and the probability of PHI being compromised. Unless an organization can demonstrate a low probability of compromise based on a risk assessment, the incident is presumed to be a breach.

 

Types of breaches and examples

Breaches can occur in many ways, including:

  • Theft or loss of devices: Laptops, smartphones, or USB drives containing PHI that are stolen or misplaced.
  • Unauthorized access: Employees accessing PHI without a work-related reason.
  • Hacking and IT incidents: Cyberattacks, ransomware, or unauthorized network access.
  • Improper disposal: Discarded medical records not properly shredded or destroyed.
  • Human error: Sending PHI to the wrong recipient.

Go deeper: Types of breaches

 

Breach notification requirements under HIPAA

The HIPAA Breach Notification Rule requires covered entities and their business associates to notify certain parties after a breach of unsecured PHI. These parties include:

  • Affected individuals
  • The HHS Secretary (via OCR)
  • Prominent media outlets (in some cases)

 

Notifying the HHS of a data breach

Before (and after) notifying the HHS of a (potential) data breach, there are a couple of things to consider: 

Step 1: Determine the breach size

Reporting timelines depend on breach size. Therefore, before notifying the HHS, organizations must determine how many individuals were affected. The number of individuals impacted dictates both the timeline and the method of reporting. As the HHS states, “If the number of individuals affected by a breach is uncertain at the time of submission, the covered entity should provide an estimate, and, if it discovers additional information, submit updates.”

  • Breaches affecting 500 or more individuals: Must be reported to HHS without unreasonable delay and no later than 60 calendar days after discovery.
  • Breaches affecting fewer than 500 individuals: Can be logged and reported annually within 60 days of the end of the calendar year of which the breach was discovered.

 

Step 2: Notify affected individuals

Before notifying the HHS, healthcare organizations must ensure affected individuals are informed of the breach. Notification must occur without unreasonable delay and no later than 60 days from discovery.

Requirements for individual notifications:

  • Written notice by first-class mail to the individual’s last known address.
  • Email notice is acceptable if the individual has agreed to electronic communication.
  • If contact information is incomplete:
    • For fewer than 10 individuals, a substitute notice may be given by telephone or alternative written means.
    • For 10 or more individuals, organizations must post a notice on their website or through major media outlets.

The notification must include:

  • Brief description of the breach.
  • Types of PHI involved (e.g., name, date of birth, Social Security number, diagnoses, financial information).
  • Steps individuals should take to protect themselves.
  • What the entity is doing to investigate and mitigate harm.
  • Contact information (toll-free phone number, email, mailing address, or website).

Go deeper: How to notify affected individuals of a breach

Read also: Managing patient communication during data breaches

 

Step 3: Notify the HHS Secretary

After notifying the affected individuals, the HIPAA-regulated entity can notify the HHS using the HHS Breach Notification Portal

To notify HHS, organizations must use the OCR Breach Notification Portal (sometimes called the “Wall of Shame” portal).

This secure tool requires organizations to provide detailed information about the breach.

What information must be submitted?

  • Covered entity or business associate name
  • Contact information for a responsible individual
  • Number of individuals affected
  • Type of breach (e.g., hacking/IT incident, theft, loss, unauthorized disclosure)
  • Location of the breached information (e.g., desktop, laptop, email, paper records, network server)
  • Types of PHI involved (e.g., full name, date of birth, SSN, financial data, medical information)
  • Brief description of what happened
  • Safeguards in place prior to the breach (encryption, password protection, firewalls, etc.)
  • Mitigation efforts taken to minimize harm
  • Whether law enforcement is involved (in some cases, notification can be delayed to avoid interfering with an investigation)

According to HHS, “If only one option is available in a particular submission category, the covered entity should pick the best option, and may provide additional details in the free text portion of the submission. If a covered entity discovers additional information that supplements, modifies, or clarifies a previously submitted notice to the Secretary, it may submit an additional form by checking the appropriate box to indicate that it is an addendum to the initial report, using the transaction number provided after its submission of the initial breach report.”

OCR reviews these submissions to ensure compliance and may initiate investigations based on the reported information.

 

Step 4: Notify the media (if applicable)

If a breach affects 500 or more residents of a state or jurisdiction, organizations must also notify prominent media outlets serving that area.

The notice must be provided without unreasonable delay and no later than 60 days after discovery. Moreover, it must contain the same information as the individual notices.

This requirement ensures public awareness when large-scale PHI breaches occur.

 

Step 5: Document the breach

“Covered entities and business associates, as applicable, have the burden of demonstrating that all required notifications have been provided or that a use or disclosure of unsecured protected health information did not constitute a breach,” says the HHS. Documentation must indicate that “all required notifications were made, or, alternatively, documentation to demonstrate that notification was not required: (1) its risk assessment demonstrating a low probability that the protected health information has been compromised by the impermissible use or disclosure; or (2) the application of any other exceptions to the definition of “breach.””

Read also: Guidelines for HIPAA compliant documentation and record retention

 

Templates and resources

The HHS provides guidance and templates to assist covered entities in fulfilling their notification obligations. These resources include sample breach notification letters and step-by-step instructions for reporting incidents.

 

Consequences of failing to notify HHS

Failure to notify HHS of a breach can result in significant penalties. The OCR enforces compliance and can impose fines based on the level of negligence, ranging from $141 to $71,146 per violation. Prompt and thorough notification not only mitigates potential harm to individuals but also protects the organization from legal and financial consequences.

 

Common challenges in reporting breaches

  • Delayed detection: Breaches may go unnoticed for weeks or months. According to IBM's 2021 Cost of a Data Breach Report, as noted by VentureBeat, organizations take an average of 212 days to identify a breach and an additional 75 days to contain it, totaling 287 days.
  • Incomplete information: Lack of detailed records can hinder the risk assessment and the notification process.
  • Coordination with multiple parties: Large breaches may involve several departments or business associates, complicating reporting.
  • Maintaining compliance: Keeping up with evolving HIPAA regulations and HHS guidance requires continuous training and policy updates.

Best practices for HIPAA breach notification

To reduce risk and ensure compliance, healthcare organizations should adopt the following best practices:

  • Develop a breach response plan: Create clear policies outlining breach identification, risk assessment, notification responsibilities, and reporting procedures.
  • Train employees: Employees should understand how to recognize a breach, whom to notify internally, and what their role is in the response.
  • Conduct risk assessments: Evaluate the probability of PHI compromise and document findings. This helps determine if an incident is reportable.
  • Encrypt PHI: Encrypted data is considered secured under HIPAA, which means unauthorized access does not trigger notification obligations.
  • Maintain strong vendor agreements: Ensure business associates are contractually required to notify you of breaches promptly.
  • Keep detailed records: Document all breach response actions and communications. This will be critical in case of an OCR audit or investigation.

See also: HIPAA Compliant Email: The Definitive Guide (2025 Update)

 

FAQS

Who is responsible for reporting a breach to HHS?

Both covered entities and business associates are responsible for reporting breaches involving PHI under their control.

 

What happens after an organization reports a breach to HHS?

OCR may review your report and decide to investigate further. They will assess whether you complied with HIPAA requirements and may request additional documentation.

 

What should be done immediately after discovering a breach?

  • Contain the breach and secure PHI.
  • Conduct a risk assessment to evaluate potential compromise.
  • Notify internal compliance and legal teams.
  • Prepare notifications for affected individuals and, if applicable, media outlets.