HIPAA breach notification: deadlines and the software that tracks them
Breach notice deadlines run from the day of discovery, and teams lose days rebuilding dates and counts from scattered systems. Agnotic Technologies builds incident and notification software to your requirements, so each notice, recipient and latest date is tracked from day one.
Last reviewed by the Agnotic Technologies engineering team
When are HIPAA breach notices due?
HIPAA breach notices are due without unreasonable delay and no later than 60 calendar days after discovery, under 45 CFR 164.404 to 164.410. Breaches affecting fewer than 500 people are reported to HHS within 60 days after the calendar year ends. Agnotic Technologies builds incident software that records the discovery date and tracks each notice to its deadline.
What goes wrong in a breach response?
The rule's dates are fixed. Most trouble comes from data that is missing when the clock is already running.
Discovery date rebuilt after the fact
The 60-day clock starts on the first day anyone in the workforce knew, or should have known, of the breach. If no log records that moment, teams argue about the start date while the window closes.
Counts by state that take days
Media notice turns on more than 500 residents of one state or jurisdiction. Without affected records grouped by address, that threshold is a guess.
Out-of-date contact details
Ten or more people with missing or out-of-date contact details trigger substitute notice under 164.404(d)(2), which teams often find out late.
Small breaches forgotten by year end
Breaches under 500 people are logged and reported to HHS within 60 days after the calendar year ends. A spreadsheet nobody owns misses that date.
Business associate handoffs without the facts
A business associate must identify each affected person where possible under 164.410(c). Missing identities slow every notice the covered entity sends.
No proof of when each notice went out
Without a log of channel and send date, a team cannot show that the individual, media and HHS notices met their deadlines.
What do we build for breach response?
Agnotic Technologies builds incident and notification software to your requirements, as a separate internal tool or inside the health software you already run. These are the features we typically build.
Incident intake and discovery-date capture
A form and API that record who first knew, when and how, in an append-only log nobody can edit after the fact.
Affected-individual counting by state
Queries that group affected records by each person's state of residence, so the media notice threshold is answered from data.
Contact data quality checks
Flags for missing or returned addresses that show early whether substitute notice under 164.404(d)(2) is needed.
Notice deadline tracking
Each notice required under 45 CFR 164.404 to 164.408, with its recipient and latest date, and alerts as that date approaches.
Notice letter generation
Letters built from templates that carry the content 164.404(c) lists, with a review and approval step before anything is sent.
HHS log for breaches under 500
A yearly breach log that holds each small breach through the calendar year, ready for the report to the Secretary.
Law enforcement delay records
Fields for the official's name, the date and whether the request was oral or written, so a delay under 164.412 is documented.
Audit trail and notice log
Every notice, its channel, its send date and the user who sent it, kept for the response file.
Which notices does the Breach Notification Rule require?
The rule sets an outer limit for each notice. It also requires notice without unreasonable delay, so the latest date is never the target.
| Notice | Who sends it, to whom | When it applies | Latest date | Rule |
|---|---|---|---|---|
| Individual notice | Covered entity to each affected person | Every breach of unsecured PHI | 60 calendar days after discovery | 164.404 |
| Media notice | Covered entity to prominent outlets in the state | More than 500 residents of one state or jurisdiction | 60 calendar days after discovery | 164.406 |
| HHS notice, 500 or more | Covered entity to the Secretary | 500 or more individuals in total | With the individual notices | 164.408(b) |
| HHS notice, under 500 | Covered entity to the Secretary | Fewer than 500 individuals | 60 days after the end of the calendar year | 164.408(c) |
| Business associate notice | Business associate to the covered entity | Every breach the business associate discovers | 60 calendar days after discovery | 164.410 |
| Substitute notice | Covered entity, by web posting or media | 10 or more people with out-of-date contact details | Part of the individual notice | 164.404(d)(2) |
How do you count the 60 days?
The clock starts on the day of discovery: the first day the breach is known, or would have been known with reasonable diligence, to anyone in the workforce or an agent other than the person who caused it.
The days are calendar days, so weekends and holidays count. Day 60 is a limit, not a target: a notice sent late in the window must still meet the without unreasonable delay standard.
A law enforcement official can delay notice under 45 CFR 164.412. A written request sets its own period; an oral one delays notice for no more than 30 days unless a written request follows.
What do the federal deadlines not settle?
- Whether the incident is a breach at all. That depends on the risk assessment in 45 CFR 164.402 and on whether the PHI was unsecured.
- State breach laws, which can set shorter deadlines or different thresholds.
- Shorter windows set in your business associate agreement.
- The content each notice must include, which 164.404(c) lists.
- How a law enforcement delay changes your dates in a specific case.
- Legal advice. Confirm the dates with counsel before you act on them.
How does Agnotic build breach response software?
For the controls that prevent a breach in the first place, see PHI data security engineering.
Agree on a scoping call which systems hold the affected records and which logs show the discovery date.
Pull counts by state and contact data quality from the source systems, so the figures behind each notice are exact.
Build incident intake, notice tracking and the audit trail into your product, or as a separate internal tool.
Fix the control that failed, then map the remaining gaps against the HIPAA Security Rule checklist.
What does the rule text say?
Each fact is from the current eCFR text of 45 CFR Part 164 Subpart D.
A covered entity must notify each affected individual without unreasonable delay and in no case later than 60 calendar days after discovery of a breach of unsecured protected health information (45 CFR 164.404(b)).
Source: 45 CFR 164.404 (eCFR)A breach involving more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that state or jurisdiction, within the same 60-day limit (45 CFR 164.406).
Source: 45 CFR 164.406 (eCFR)Breaches involving 500 or more individuals are reported to the Secretary at the same time as the individual notices; smaller breaches are logged and reported within 60 days after the end of each calendar year (45 CFR 164.408).
Source: 45 CFR 164.408 (eCFR)A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach, identifying each affected individual where possible (45 CFR 164.410).
Source: 45 CFR 164.410 (eCFR)If a law enforcement official states orally that notice would impede an investigation, notice is delayed for no longer than 30 days from the statement unless a written statement is submitted (45 CFR 164.412(b)).
Source: 45 CFR 164.412 (eCFR)
Trusted by global innovators
Which standards does Agnotic build healthcare software against?
HIPAA
Health Insurance Portability and Accountability Act
Protect PHI with privacy-first architecture, encrypted storage and transmission, strict access controls, and traceable audit logs.
GDPR
General Data Protection Regulation
Implement lawful consent flows, data minimization, retention controls, and secure processing for sensitive health data.
FHIR
Fast Healthcare Interoperability Resources
Enable standardized health data exchange across apps, care teams, and systems through standards-based FHIR APIs.
HL7
Health Level Seven International
Support enterprise-grade interoperability with HL7-based integrations for records, events, and clinical messaging workflows.
HITRUST
Health Information Trust Alliance
Align security programs to healthcare-specific control and risk management practices trusted by providers and ecosystem partners.
HITECH
Health Information Technology for Economic and Clinical Health Act
Design with breach notification readiness, digital record safeguards, and operational controls that support regulated care programs.
SaMD
FDA Software as a Medical Device
Plan software quality, traceability, and documentation pathways for products that may require SaMD review and submission.
MDR (EU)
Medical Device Regulation (European Union)
Prepare EU market-ready processes for risk classification, evidence tracking, and lifecycle governance under MDR expectations.
SAMHSA
Substance Abuse and Mental Health Services Administration
Apply confidentiality controls and consent-aware sharing models for behavioral and mental health data experiences.
Where should you go next?
- HIPAA Security Rule safeguards in softwareEvery safeguard in the rule, in order, with required and addressable tags.
- HIPAA app engineering controlsSecurity Rule controls written as engineering tasks for app teams.
- HIPAA compliance consultingGap and risk analysis for health software teams.
- PHI data securityEncryption, tokenization and access controls for protected health information.
- Compliance engineeringHIPAA, SOC 2, GDPR and FDA requirements turned into build decisions.
- Healthcare compliance management softwareExclusion screening, policy attestations, training records and risk analysis tracking.