Awareness article
HIPAA Breach Notification Timelines
A deadline-focused guide for small clinics on when to notify individuals, HHS, the media, and the covered entity when a breach is confirmed.
The legal deadline is not your internal deadline.
Why clinics should work backward
Drafting notices, confirming affected individuals, coordinating leadership, and preparing regulator-facing language all take time. If the team starts late, the outer deadline arrives faster than expected.
A usable workflow
Track the discovery date, whether the event crosses reporting thresholds, who owns the notices, what draft status exists, and which dependencies are blocking completion. That should all live in one incident record, not across separate inboxes.
A practical operating rule
Set internal milestones well before the outside deadline. Clinics that treat the statutory deadline as the working deadline usually create preventable stress and inconsistent documentation.
Incident Response
How to determine whether an incident is a reportable breach, document the analysis, and meet notification obligations.
What Counts as a HIPAA Breach
What counts as a HIPAA breach? Learn how small clinics distinguish incidents from reportable breaches.
The Four-Factor Breach Risk Assessment
The four-factor breach risk assessment explained for small clinics, with practical documentation guidance.
Sources
- Breach Notification Rule · HHS
- Breach Notification Guidance · HHS
- OCR Breach Portal · HHS