HIPAA Breach Response Playbook: Clocks, Assessments, Notices

After an impermissible acquisition, access, use, or disclosure of unsecured PHI, notification is required unless you document a low probability of compromise across all four factors: (1) the nature and extent of the PHI, identifiers and likelihood of re-identification (an SSN or diagnosis weighs heavier than a name alone); (2) the unauthorized person who received or accessed it (a fellow covered entity under HIPAA duties weighs lighter than an unknown attacker); (3) whether PHI was actually acquired or viewed, forensics matters here; (4) mitigation, such as recovered devices or signed attestations of destruction. The assessment is optional: you may skip it and notify. What you may not do is decide 'low risk' without a written analysis, that document is the first thing OCR requests.

Individuals: written notice by first-class mail (or email if agreed) without unreasonable delay, outer limit 60 calendar days from discovery, containing what happened, PHI involved, steps individuals should take, what you are doing, and contact information; substitute notice (website posting or media) applies when contact information is insufficient for 10+ people. HHS: through the portal, contemporaneous with individual notice for 500+ breaches, or within 60 days after calendar year-end for smaller ones. Media: for 500+ residents of a state, notice to prominent media outlets there. Business associates: notify the covered entity without unreasonable delay, outer limit 60 days, though BAAs commonly compress this to 5-10 business days. State laws overlay shorter clocks and AG notices; run both matrices.

At discovery, which is the first day the breach is known, or by reasonable diligence would have been known, to any workforce member or agent other than the person who committed the breach. This imputed-knowledge standard means a help-desk ticket describing odd mailbox rules, an unexplained EDR alert closed without review, or a patient complaint about a misdirected letter can each start the clock long before leadership hears about the incident. Two operational consequences: train front-line staff to escalate suspected PHI incidents immediately, and document the discovery-date analysis in the breach file, OCR probes it, and 'when the CISO was told' is not the standard.

The rule applies only to unsecured PHI, PHI not rendered unusable, unreadable, or indecipherable per HHS guidance, which specifies NIST-consistent encryption (for data at rest, consistent with SP 800-111; in transit, TLS/VPN per SP 800-52/77/113) and proper destruction for media. If a stolen laptop's drive was encrypted to standard and the key was not compromised, the loss is not a notifiable breach at all: no assessment, no letters, no HHS entry. This is the strongest ROI argument in the rule, full-disk encryption on portable devices retires the single most common historical breach category (lost and stolen hardware) entirely. Document the encryption state per device class so the safe-harbor claim is provable on the worst day.

The incident timeline with the discovery-date analysis; forensic findings; the four-factor assessment (or the decision to notify without one); copies of individual, HHS, media, and substitute notices with dates; the affected-individual count methodology; business associate reports and BAA deadline compliance; mitigation and sanctions applied; and the root-cause remediation plan, which OCR reads against your risk analysis to see whether the breached vector was a known, unremediated risk. Retention is six years. OCR has settled over notification timeliness alone (Presence Health, $475,000, for notices sent months late), so the file must prove not just that you notified but when each clock started and ended.