Law note · United States
HIPAA Breach Notification Rule
cite 45 CFR Part 164, Subpart D (Sections 164.400-164.414)
stage In effect
since 2009-09-23
reviewed 2026-08-23
Requires a covered entity to notify each affected individual, and in some cases HHS and the media, following discovery of a breach of unsecured protected health information, without unreasonable delay and no later than 60 calendar days after discovery. First effective under a 2009 interim final rule; the 2013 HIPAA Omnibus Rule finalized these requirements with a general compliance date of September 23, 2013.
What it asks of an app
- Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
- Notify HHS, and for a breach affecting more than 500 residents of a state, prominent media outlets serving that state.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: eCFR, current regulatory text, 45 CFR Part 164 Subpart D