The Breach Notification Rule: The Four-Factor Test, the 60-Day Clock and the HHS Breach Portal

Rule versions described: the HIPAA Breach Notification Rule at 45 CFR 164.400 to 164.414, first issued as an interim final rule on August 24, 2009 (74 FR 42740) and made final, with the "harm" standard replaced, by the Omnibus Rule of January 25, 2013 (78 FR 5566); HHS guidance on rendering PHI unusable (74 FR 19006, April 27, 2009, as updated August 24, 2009); the OCR ransomware fact sheet of July 11, 2016; the FTC Health Breach Notification Rule at 16 CFR Part 318 as amended May 30, 2024 (89 FR 47028); and Idaho Code 28-51-104 to 28-51-107. Current eCFR and Idaho Legislature text read October 28, 2026. The proposed HIPAA Security Rule update (90 FR 898, January 6, 2025) is still a proposal and does not change the breach rule. Rules change: check the regulator's current text before you rely on any line here.

Most HIPAA rules are about prevention. The Breach Notification Rule is about what happens after prevention fails. It decides whether a mistake or an attack becomes a letter in a patient's mailbox, a line on a federal web page, a story in the local paper and, often, the start of a federal investigation. It is also the rule most people in health care meet first, usually on a bad day, with a vendor on the phone and a manager asking whether this "counts."

This lesson works through the rule section by section: where it came from, what counts as a breach, how encryption and destruction take an incident out of the rule, how the four-factor risk assessment works on real situations, how the 60-day clock runs, what each notice must say and who must receive it, what business associates owe, how the HHS breach portal works and how to read it, how the FTC rule covers apps that HIPAA misses, and how Idaho's law runs beside the federal one. Lesson 3 of course 69, Health Privacy: HIPAA and Beyond, gives the short overview; this lesson goes further into the mechanics. The Security Rule safeguards that keep incidents from becoming breaches are in lesson 3, and the risk analysis that should have found the weak spot first is in lesson 4.

Where the rule came from

The HITECH Act of 2009

The original 1996 HIPAA statute and the Privacy and Security Rules that followed it did not require anyone to tell patients when their records were lost or stolen. A covered entity had to "mitigate, to the extent practicable" any harmful effect of a known improper disclosure, but that duty did not include a letter to the patient. Congress changed that in the Health Information Technology for Economic and Clinical Health Act, the HITECH Act, which was part of the American Recovery and Reinvestment Act signed February 17, 2009. Section 13402 of HITECH, codified at 42 U.S.C. 17932, requires covered entities to notify individuals of breaches of "unsecured protected health information," requires business associates to notify covered entities, and requires notice to the media and to the Secretary of HHS for larger breaches. It also directs HHS to post a public list of large breaches on its website, which is the origin of the breach portal discussed below.¹⁰

The statute left two important questions to HHS. First, what makes PHI "secured," so that losing it does not trigger notice? Section 13402(h)(2) told HHS to issue guidance naming the technologies and methods that render PHI "unusable, unreadable, or indecipherable to unauthorized individuals." HHS published that guidance on April 27, 2009 (74 FR 19006) and updated it with the breach rule in August.¹¹ Second, what exactly is a "breach"? The statute defined it as the unauthorized acquisition, access, use or disclosure of PHI which "compromises the security or privacy" of the information, and left it to HHS to say what "compromises" means.

The 2009 interim final rule and the "harm" standard

HHS answered with an interim final rule, "Breach Notification for Unsecured Protected Health Information," published August 24, 2009 at 74 FR 42740 and effective September 23, 2009.¹² In that first version, a disclosure "compromises the security or privacy" of PHI only if it "poses a significant risk of financial, reputational, or other harm to the individual." Covered entities had to perform and document a risk assessment, and if they concluded the harm risk was not significant, no notice was required. The interim rule also excluded certain limited data sets (records stripped of the 16 direct identifiers and also of dates of birth and ZIP codes) from the breach definition.

The harm standard was contested from the start. One side argued that it spared patients needless alarm and cost over trivial slips, such as a lab result handed to the wrong nurse on the same unit. The other side argued that it let the organization that lost the data decide, on its own and with its own reputation at stake, whether the patient deserved to know. HHS took public comments on the interim rule and rewrote the standard in 2013.

The 2013 Omnibus Rule and the presumption of breach

The final Breach Notification Rule came in the Omnibus Rule, published January 25, 2013 at 78 FR 5566, effective March 26, 2013, with compliance required by September 23, 2013. In HHS's words, the final rule "replaces the breach notification rule's 'harm' threshold with a more objective standard" and supplants the 2009 interim rule.¹³ The new standard is the one in force today. An impermissible use or disclosure is presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI has been compromised, based on a risk assessment of at least four factors. The Omnibus Rule also dropped the limited data set exclusion, so those data sets now go through the same four-factor analysis as everything else.¹

The change moved the burden. Under the 2009 version, the question was "will this hurt the patient?" Under the 2013 version, the question is "can we prove the information was not compromised?" Notice is the default, and the documentation has to justify any exception.

Part 2 substance use disorder records now follow the same rule

Section 3221 of the CARES Act of 2020 extended HITECH's breach notification requirements to records covered by 42 CFR Part 2, the federal confidentiality rule for substance use disorder treatment programs. HHS implemented that in its February 16, 2024 Part 2 final rule (89 FR 12472), with a compliance date of February 16, 2026.¹⁴ Part 2 programs now notify patients and HHS of breaches of unsecured Part 2 records in the same way HIPAA entities do, and OCR runs a separate public list for them. On October 28, 2026, that list, titled "Notice to the Secretary of HHS Breach of Unsecured Part 2 Records," showed no records under investigation.¹⁵ Lesson 2, The Privacy Rule and Part 2, covers Part 2 itself.

The rule section by section

The rule is short. It sits in Subpart D of 45 CFR Part 164, eight sections in all, and is worth reading once in full.¹⁶

Three Privacy Rule administrative requirements also apply to breach work, by cross-reference: training the workforce on breach procedures, applying sanctions to staff who fail to follow them, and keeping documentation for six years (45 CFR 164.530(b), (e) and (j)).¹⁷ The Security Rule adds the duty to have security incident procedures that identify and respond to suspected or known incidents and document their outcomes (45 CFR 164.308(a)(6)).¹⁸ Those procedures are where a breach investigation begins.

What counts as a breach

The definition, word by word

Section 164.402 defines a breach as "the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information."¹ Each part of that sentence does work:

• Protected health information. PHI is individually identifiable health information held or transmitted by a covered entity or business associate, in any form: electronic, paper or oral. It does not include employment records a covered entity holds as an employer, education records covered by FERPA, or information about a person who has been dead more than 50 years (45 CFR 160.103).¹⁹ Information properly de-identified under the Privacy Rule is not PHI at all, so its loss is not a HIPAA breach.
• Acquisition, access, use or disclosure. The rule reaches more than theft. A person who only looks at a record (access), a staff member who uses data for a purpose not allowed (use), and a mailing sent to the wrong address (disclosure) are all covered. Data does not have to leave the building.
• Not permitted under subpart E. Subpart E is the Privacy Rule. If the Privacy Rule allowed the use or disclosure (treatment, payment, health care operations, a valid authorization, a required public health report), there is no breach. A disclosure that was permitted but exceeded the "minimum necessary" standard is not permitted, and it can be a breach.
• Compromises the security or privacy. Since 2013, this phrase is tied to the presumption and the four-factor test, covered below.

A breach is different from a "security incident." The Security Rule defines a security incident as the attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations (45 CFR 164.304).²⁰ A blocked phishing email is a security incident and not a breach. An incident becomes a possible breach when PHI may have been acquired, accessed, used or disclosed in a way the Privacy Rule does not allow.

The three exceptions

The definition has three exceptions, in paragraph (1) of the 164.402 definition. If one applies, the event is not a breach and no notice is required, though the organization should still document why.

1. Good-faith, unintentional workforce access. An unintentional acquisition, access or use of PHI by a workforce member or a person acting under the authority of a covered entity or business associate, made in good faith and within the scope of that person's authority, that does not result in further use or disclosure the Privacy Rule does not allow. Example: a billing clerk opens the wrong patient's account because two patients share a name, sees the mistake, closes it and tells her supervisor. Not covered: a nurse who looks up a neighbor's chart out of curiosity. That was not in good faith and not within the scope of her authority.
2. Inadvertent disclosure between authorized people. An inadvertent disclosure by a person who is authorized to access PHI at a covered entity, business associate or organized health care arrangement to another person authorized to access PHI at the same entity, business associate or arrangement, with no further impermissible use or disclosure. Example: a physician emails a consult note to the wrong physician in the same hospital system, who deletes it.
3. The recipient could not have retained it. A disclosure where the covered entity or business associate has a good-faith belief that the unauthorized person who received it would not reasonably have been able to retain the information. Example: a nurse hands discharge papers to the wrong patient, realizes it immediately and takes them back before the patient could read them.

These exceptions are narrow and fact-specific. They are not general "it was an honest mistake" exemptions. A misdirected letter mailed to a stranger outside the organization does not fit any of them: the recipient was not authorized and could keep the letter. That goes to the four-factor test.

Unsecured PHI and the encryption and destruction safe harbor

What "unsecured" means

The notice duty applies only to breaches of "unsecured protected health information," defined in 164.402 as PHI "that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2)" of HITECH.¹ In practice, that is often called the encryption safe harbor, although the guidance covers destruction too.

HHS's guidance names exactly two ways to secure PHI.²¹¹

Two of the named standards have moved since HHS last reviewed the guidance page (its stated review date is July 26, 2013). NIST published SP 800-88 Revision 2 on September 26, 2025, superseding Revision 1 of December 2014.²¹ And NIST's Cryptographic Module Validation Program moved all FIPS 140-2 validations to its historical list in September 2026 under the transition to FIPS 140-3, while saying it still supports the use of those modules in existing systems.²² HHS has not reissued the breach guidance to reflect either change. Many security teams read the guidance as pointing to the current NIST documents and prefer FIPS 140-3 validated modules for new purchases, but that is a reading, not an HHS statement. If your encryption choice will decide whether thousands of letters go out, check the current text with your security lead and compliance officer.

The conditions that break the safe harbor

Encryption only helps if it was actually protecting the data when the breach happened. Four situations commonly defeat it:

• The key went with the data. A laptop with full-disk encryption and the password on a sticky note in the bag is not secured. The guidance says the decryption tools must be stored separately from the data.
• The device was running and logged in. OCR's 2016 ransomware fact sheet points out that "many full disk encryption solutions will transparently decrypt and encrypt files accessed by the user." Full-disk encryption protects a powered-off device. If malware runs inside a logged-in session, the files it reaches are decrypted at that moment and are treated as unsecured PHI.²³
• The encryption was not what the policy said. Investigations often find that a device inventory claimed encryption that was never turned on, or that one older machine was skipped.
• Only some of the data was encrypted. Encrypted databases with unencrypted exports, backups or email attachments leave the exports unsecured.

The safe harbor is the reason the Lifespan case cost so much. On April 21, 2017, Lifespan filed a breach report about the theft of an affiliated hospital employee's unencrypted laptop holding the names, medical record numbers, demographic information and medication information of 20,431 patients. OCR found a failure to encrypt ePHI on laptops after Lifespan had itself determined encryption was reasonable and appropriate, along with weak device and media controls and a missing business associate agreement. Lifespan paid $1,040,000 under a July 27, 2020 settlement.²⁴ The same theft with working encryption and a separately stored key would have been a documented non-event.

The four-factor risk assessment

Start from the presumption

Paragraph (2) of the 164.402 breach definition sets the default: "an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors."¹ Two points follow from the wording. The organization does not have to do the assessment; it may simply notify. And if it wants to avoid notice, the assessment has to consider "at least" the four factors, so other relevant facts can and should be added.

Factor 1: the nature and extent of the PHI

The first factor is "the nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification." Questions to answer: Which data elements were involved? Were there direct identifiers such as names, Social Security numbers, member IDs or medical record numbers? Was there financial information that invites fraud? How sensitive was the clinical content: a flu shot date, or a mental health, HIV, substance use or reproductive health diagnosis? If identifiers were missing, could the data be re-identified by combining it with other information? A list of appointment times with no names is low risk. The same list with names and "oncology" is not.

Factor 2: the unauthorized person

The second factor is "the unauthorized person who used the protected health information or to whom the disclosure was made." Who got it matters. Another HIPAA covered entity that received a misdirected record is itself bound to protect PHI, which lowers the risk. A criminal group that steals data to sell it, or to extort the organization, is the opposite. A former spouse, an employer or a neighbor can be the most damaging recipient of all for one patient, even if only one record is involved.

Factor 3: whether the PHI was actually acquired or viewed

The third factor is "whether the protected health information was actually acquired or viewed." Forensic evidence carries weight here. A stolen laptop recovered by police with forensic proof that it was never powered on is different from one that disappeared. A misdirected envelope returned unopened by the post office is different from one opened and read. For attacks on networks, the question becomes whether the attacker moved data out (exfiltration) or only had the ability to reach it. Absent logs that answer the question, the organization usually cannot show a low probability.

Factor 4: how far the risk was mitigated

The fourth factor is "the extent to which the risk to the protected health information has been mitigated." Common examples are a signed attestation from a recipient that the information was destroyed and not kept or shared, a confirmed remote wipe of a lost phone, and a court order or takedown. Mitigation is more convincing when the recipient is trustworthy (another provider) than when it is a stranger who has every reason to say yes.

Documenting the assessment

Under 164.414, the covered entity or business associate carries the burden of showing that a use or disclosure did not amount to a breach, or that all required notices were made.²⁵ Under 164.530(j), the documentation must be kept for six years.¹⁷ A useful record states the facts known and when they were learned, the analysis of each factor with the evidence relied on, any other factors considered, the conclusion, who made it and the date. A note that says only "low risk, no notification" will not carry the burden.

Organizations also have to apply the test honestly. The four factors are weighed together. A favorable answer on one factor does not cancel a bad answer on another, and when the facts are unclear the presumption controls.

Worked examples

The examples below are composites built to show how the factors work. They are teaching cases, not legal opinions, and real outcomes turn on facts. Where a real case matches, it is named.

A misdirected fax

A medical assistant at a family practice faxes a two-page referral (name, date of birth, insurance member number, diagnosis of type 2 diabetes, medication list) to an endocrinology office. One digit is wrong, and the fax goes to a local auto parts store. The store manager calls the next morning, says he read enough to know it was medical, and offers to shred it.

• Exceptions: None fit. The store is not an authorized person, and the manager read the page, so exception (iii) is out.
• Factor 1: Direct identifiers and a member number, moderately sensitive clinical data.
• Factor 2: A local business with no apparent motive, which called on its own.
• Factor 3: Viewed, by his own account.
• Factor 4: The practice obtains a signed statement that the pages were shredded and not copied, photographed or shared, and confirms the store's fax machine does not store images or forward to email.

Many compliance officers would document this as a low probability of compromise: one recipient, identified, cooperative, with a signed destruction attestation. Others would notify anyway because the page was read and the member number could be misused. Either way, the assessment must be written down. The fix is the same: preprogrammed fax numbers for frequent recipients, a test page for new numbers, and a review of whether fax is needed at all. If the same wrong number recurs, or the recipient is hostile, the answer changes.

A lost encrypted laptop

A care coordinator leaves a laptop on a bus. The laptop has full-disk encryption validated to FIPS standards, the IT log confirms encryption was active, the device was powered off, and the coordinator's password was not written down anywhere. IT disables her account and the device's access to the network the same day.

This is the safe harbor at work. The PHI on the device was not "unsecured," so the breach rule does not apply and no notice is required.² The organization should still document the device, the encryption status evidence, the key handling and the steps taken. It should also check state law: Idaho's law, for example, applies only to unencrypted data, so it would not require notice either.²⁶

A lost unencrypted laptop

Same bus, but the laptop is an older machine that was never encrypted, and it holds a spreadsheet of 2,300 patients with names, dates of birth, medical record numbers and diagnoses. The laptop is not recovered.

No exception applies, the data was unsecured, and the four factors all point toward compromise: direct identifiers and clinical data, an unknown recipient, no way to show it was not viewed, and nothing to mitigate. This is a breach. Every patient gets a letter within 60 days of the day the loss was known, HHS gets a report at the same time because the count is 500 or more, and if more than 500 of those patients live in one state, prominent media outlets there get notice too. This is the fact pattern of the Lifespan settlement described above.²⁴

An employee who snoops

An audit of electronic health record access logs shows a scheduling clerk opened the records of 40 patients over eight months, none of whom she was scheduling. Several were coworkers and relatives of a former partner.

The good-faith exception does not apply: the access was intentional and outside the scope of her job. The PHI was viewed. The person who viewed it had personal motives. Unless the investigation produces convincing evidence that nothing was copied or shared, the 40 patients get notice, the incident goes in the annual log to HHS (it is under 500), and the clerk faces sanctions under the organization's policy as 164.530(e) requires.¹⁷ Insider cases also reach the HHS portal when they are large. In January 2025, HIPAA Journal reported that Eastern Idaho Public Health had listed 759 people on the HHS portal after a former employee accessed patient clinic notes without authorization.²⁷ And in February 2024, OCR announced a $4,750,000 settlement with Montefiore Medical Center in New York in a case involving a malicious insider.²⁸

The discovery date in snooping cases deserves care. The clock starts when the organization knew or, with reasonable diligence, would have known. An organization that never reviews access logs may find that OCR treats an insider's months of activity as discoverable long before the audit that finally caught it.

Ransomware

Ransomware encrypts the file server at a 12-provider clinic on a Saturday night. The server holds scanned intake forms and exported billing files for about 9,000 patients. The attackers' note says they copied the data and will publish it.

OCR answered the ransomware question in its July 11, 2016 fact sheet. When ePHI is encrypted by ransomware, "a breach has occurred because the ePHI encrypted by the ransomware was acquired," meaning unauthorized people took possession or control of it, and so "a breach of PHI is presumed to have occurred" unless the entity can show a low probability of compromise through the four-factor assessment.²³ The fact sheet adds two points that matter in nearly every ransomware case:

• The assessment should consider whether the PHI was exfiltrated, and a "high risk of unavailability of the data, or high risk to the integrity of the data" may itself indicate compromise.
• Data the organization had encrypted for HIPAA purposes is not automatically safe. If the ransomware reached files while they were decrypted for a logged-in user, they were "unsecured PHI" at that point.

In the example, the attackers claim theft, the files had names and clinical details, and the clinic has no logs that disprove exfiltration. The presumption stands. Notice goes to 9,000 patients, to HHS at the same time, and to the media if more than 500 live in one state. An organization that wants to show low probability needs real evidence: logs showing the specific ransomware variant does not exfiltrate, network flow records with no unusual outbound traffic, restored systems with no data integrity loss. OCR's ransomware enforcement shows the cost of getting the earlier steps wrong. By its April 23, 2026 announcement OCR had completed 19 ransomware investigations, and on July 29, 2026 it announced the 21st, a $552,250 settlement with OSF HealthCare System after a 2021 ransomware attack in which PHI of 53,907 people was exfiltrated.²⁹³⁰

The examples side by side

The 60-day clock

When the clock starts: the discovery date

Under 164.404(a)(2), a breach is treated as discovered "as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity." The covered entity is deemed to know about a breach when any person other than the person committing it knows, if that person is a workforce member or agent of the covered entity, as determined under the federal common law of agency.³

Three consequences flow from that text:

• The front desk counts. Knowledge by any workforce member, not just the privacy officer, can start the clock. A receptionist who hears from a patient on March 3 that she got someone else's statement has started it, even if the privacy officer hears about it on March 20. Training staff to report immediately is what keeps those 17 days.
• "Would have known" counts. Reasonable diligence means an organization cannot avoid the clock by not looking. Ignored alerts, unread audit logs and unchecked vendor notices can all move the discovery date earlier.
• The investigation does not stop the clock. In the 2009 rule, HHS said "the time period for breach notification begins when the incident is first known, not when the investigation of the incident is complete."¹² The organization must investigate and notify inside the same 60 days, and if the investigation runs long, it may need to notify with what it knows and supplement later.

Sixty days is a ceiling, not a target

The standard is "without unreasonable delay and in no case later than 60 calendar days after discovery." The second half is a hard outer limit. The first half can be violated well before day 60. HHS said in the 2009 rule that "the 60 days is an outer limit and therefore, in some cases, it may be an 'unreasonable delay' to wait until the 60th day to provide notification."¹² An organization that has the addresses, the facts and the letter ready on day 15, then holds them until day 58, has a hard time explaining the wait.

OCR's first settlement over late notice shows the outer limit is enforced. Presence Health, an Illinois health system, discovered on October 22, 2013 that paper operating room schedules were missing from a surgery center in Joliet. The schedules held names, dates of birth, medical record numbers, procedure dates and types, surgeon names and anesthesia types for 836 patients. OCR received the breach report on January 31, 2014, and found that notice to individuals went out 104 days after discovery, 44 days past the deadline, and notice to the media 106 days after discovery. Presence Health paid $475,000 and agreed to a two-year corrective action plan in a settlement announced January 9, 2017.³¹

The business associate clock and the agency question

When the breach happens at a business associate, two clocks may run. Under 164.410, the business associate must tell the covered entity "without unreasonable delay and in no case later than 60 calendar days after discovery" by the business associate.³² The covered entity's own 60 days then usually start when it learns of the breach from the business associate.

The exception is agency. If the business associate is acting as the covered entity's agent under the federal common law of agency (for example, because the covered entity controls how it does its work), the business associate's knowledge is imputed to the covered entity, and the covered entity's clock starts on the day the business associate discovered the breach. In that case, a business associate that takes the full 60 days leaves the covered entity no time at all. Many business associate agreements set a much shorter reporting window, often a few days, for exactly this reason. Lesson 6 covers those contract terms.

Law enforcement delay

Section 164.412 lets law enforcement pause notice when notice would impede a criminal investigation or damage national security.³³ The rule draws a sharp line between written and oral requests:

• Written statement. If a law enforcement official gives a written statement that notice would impede an investigation or damage national security, and specifies the time for which a delay is required, the organization delays for that period.
• Oral statement. If the statement is oral, the organization must document it, including the identity of the official, and delay no longer than 30 days from the oral statement unless a written statement arrives in that time.

The delay applies to individual, media and HHS notice. When it ends, the remaining notice duties resume. A delay does not reset the facts: the organization should keep investigating and preparing, so it can notify promptly once the delay ends.

Notice to individuals

What the letter must say

Section 164.404(c) requires the notice to be written in plain language and to include, to the extent possible, five elements:³

1. A brief description of what happened, including the date of the breach and the date of discovery, if known.
2. A description of the types of unsecured PHI involved, such as full name, Social Security number, date of birth, home address, account number, diagnosis, disability code or other types.
3. Any steps individuals should take to protect themselves from potential harm.
4. A brief description of what the covered entity is doing to investigate the breach, to mitigate harm to individuals and to protect against further breaches.
5. Contact procedures for individuals to ask questions or learn more, which must include a toll-free telephone number, an email address, a website or a postal address.

The list is a floor. Good letters also say what the organization is offering (credit monitoring or identity restoration, when financial identifiers were involved), how a patient can check whether their medical record was altered, and whom to call with questions about care. Letters should not bury the news under paragraphs about how seriously the organization takes privacy. Patients judge the letter, and OCR reads it as part of any review.

How notice is delivered

Under 164.404(d), written notice goes by first-class mail to the individual's last known address, or by email if the individual has agreed to electronic notice and has not withdrawn that agreement. It may go out in one or more mailings as information becomes available. If the organization knows the individual has died and has the address of the next of kin or personal representative, notice goes to that person by first-class mail.³

When the situation is urgent because of possible imminent misuse of the PHI, the organization may also contact individuals by telephone or other means, in addition to the written notice, not instead of it.

Substitute notice

Mail comes back. Patients move, die or never gave a good address. Section 164.404(d)(2) sets out substitute notice when contact information is insufficient or out of date:³

Substitute notice is not required for a deceased individual whose next of kin or personal representative cannot be reached. The website posting or media notice must include the same content as the letter. A small link buried in a website footer is not a "conspicuous" posting.

Notice to the media

Section 164.406 requires notice to "prominent media outlets serving a State or jurisdiction" when a breach involves more than 500 residents of that state or jurisdiction.⁴ Three details matter:

• The count is per state. A breach of 700 people spread across Idaho, Washington and Oregon, with no state over 500, triggers no media notice under HIPAA, although it does require an HHS report at the same time as the letters because the total is 500 or more. A breach of 600 people, 520 of them in Idaho, requires media notice in Idaho.
• "Jurisdiction" can be smaller than a state. In the 2009 rule, HHS explained that "jurisdiction is a geographic area smaller than a state, such as a county, city, or town," so outlets serving that area are the right ones.¹² A rural hospital would usually notify the regional newspapers and broadcasters its patients read and watch.
• Same timing and content. The media notice follows the same 60-day outer limit and must include the same content elements as the individual letter. HHS expected that most covered entities would use a press release, and the notice is directed "to" the media; the rule does not require outlets to publish anything. Media notice supplements individual notice and never replaces it.

Notice to the Secretary of HHS

Section 164.408 requires every breach of unsecured PHI to be reported to HHS. Timing depends on size:⁵

• 500 or more individuals: "contemporaneously with the notice required by 164.404(a)," meaning at the same time as the individual letters, and in the manner HHS specifies on its website. In practice, that means the online form on the OCR breach portal.
• Fewer than 500 individuals: the covered entity maintains a log or other documentation of the breaches and, no later than 60 days after the end of each calendar year, submits them for breaches discovered during the preceding year. For a breach discovered in 2026, that deadline is March 1, 2027.

Note the different thresholds. HHS notice turns on 500 or more in total. Media notice turns on more than 500 residents of one state. A breach of exactly 500 Idaho patients triggers a contemporaneous HHS report but not HIPAA media notice.

The portal form walks the filer through screens for general information, contact information, the breach itself, notice and actions taken, and an attestation. It asks whether the filer is a covered entity or a business associate filing on a covered entity's behalf, whether a business associate was involved, the breach dates and discovery dates, the approximate number of people, the type of breach (such as theft, loss, improper disposal or unauthorized access or disclosure), where the information was (network server, email, electronic medical record, laptop, desktop, other portable device, paper or films), the clinical, demographic and financial kinds of PHI involved, the safeguards in place before the breach, the dates individual notice began, whether substitute and media notice were required, and the actions taken in response. Filers can submit an addendum later to update the count, and often do.³⁴ OCR's portal itself states that OCR "investigates all breaches of protected health information (PHI) and Part 2 records that affect 500 or more individuals."³⁵ The 2024 report on compliance shows how that works out: of 730 compliance reviews OCR opened in 2024, 665 began with a breach report.³⁶

Business associates and delegated notice

What a business associate owes the covered entity

A business associate that discovers a breach of unsecured PHI must notify the covered entity under 164.410. The business associate's discovery rule mirrors the covered entity's: the first day the breach is known, or would have been known with reasonable diligence, to any employee, officer or other agent of the business associate other than the person who committed it. The notice must identify, to the extent possible, each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed, and must include any other available information the covered entity needs for its own notice to individuals, either at the time or as it becomes available.³²

The law does not move the notice duty to the business associate. The covered entity still owes the notices to individuals, the media and HHS. What the rule allows is delegation: the covered entity and business associate can agree that the business associate will send the notices, and many business associate agreements say so. OCR's Change Healthcare guidance states the principle in one sentence: "a covered entity may delegate to its business associate the tasks of providing the required HITECH Act and HIPAA Breach Notification Rule breach notifications," while the covered entity stays responsible "for ensuring that such notifications occur."⁷

Change Healthcare: the largest breach on record

Change Healthcare, a health care clearinghouse owned by UnitedHealth Group, processes claims and payments for a large share of the U.S. health system. That made it both a covered entity (as a clearinghouse) and a business associate of thousands of providers and health plans. In prepared testimony for a May 1, 2024 House Energy and Commerce subcommittee hearing, UnitedHealth Group's chief executive said criminals used compromised credentials to enter a Change Healthcare Citrix remote access portal on February 12, 2024, that the portal did not have multifactor authentication enabled, and that ransomware was deployed nine days later, on February 21.³⁷ Claims processing stalled across the country. OCR opened investigations of Change Healthcare and UnitedHealth Group and announced them in a Dear Colleague letter dated March 13, 2024.³⁸

The notice history shows how the rule works at the extreme. According to OCR's FAQ:⁷

• On July 19, 2024, Change Healthcare filed a breach report with OCR listing 500 as the approximate number of individuals affected, because it was still determining the real number. A count of 500 on the portal is often a placeholder like this one.
• On October 22, 2024, Change Healthcare told OCR that approximately 100 million individual notices had been sent.
• On January 24, 2025, it reported about 130 million notices sent and about 190 million people affected.
• On July 31, 2025, it reported that approximately 192.7 million individuals had been affected, the largest health data breach ever reported to OCR.

OCR's FAQ also addressed the providers and plans whose patients' data was involved. It said they could delegate breach notification to Change Healthcare and that, where Change provided the required notices to HHS and to affected individuals on their behalf, "those covered entities would not have additional HIPAA breach notification obligations."⁷ That is why the HHS portal shows the event as a single filing by Change Healthcare rather than thousands of separate filings. It also means most patients got a letter from a company they had never heard of, about a clinic or insurer they did use. The 2024 report to Congress lists the largest breach of the year as one affecting about 192,000,000 people through ransomware at a health care clearinghouse, which was the figure at the time of that report.⁶ As of October 28, 2026, OCR had not announced any enforcement action against Change Healthcare; its investigation has not been publicly resolved.

Burden of proof and documentation

Section 164.414(b) puts the burden squarely on the organization: "the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach."²⁵ Paragraph (a) of the same section applies the Privacy Rule's administrative requirements in 164.530(b), (d), (e), (g), (h), (i) and (j) to breach work: workforce training, a way to receive complaints, sanctions, no retaliation against people who report, no requirement that patients waive their rights, written policies and procedures, and documentation.

Combined with the six-year retention rule in 164.530(j), the burden of proof tells you what to keep:¹⁷

• The incident report and the date it was received, by whom.
• Forensic reports, log extracts and the analysis of whether data was exfiltrated.
• The four-factor risk assessment, with evidence and the name of the person who signed off.
• For each exception relied on, the facts that fit it.
• Copies of each notice: the letter, the press release, the website posting and the HHS submission and confirmation.
• Mailing records showing dates sent, returns, and substitute notice steps.
• Any law enforcement delay statement, or the documentation of an oral request.
• The annual log of breaches under 500 and proof it was submitted.
• Policies, training records and sanctions applied.

Course 73's lesson on Detection, Incident Response and Notification covers how to build the incident response program those records come from, and course 72's When Something Goes Wrong covers the first hours of an incident for a small business. This lesson does not repeat them.

The HHS breach portal

What the portal lists

The public breach list lives on OCR's portal at ocrportal.hhs.gov. Its main page says: "As required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals." The list has three tabs: "Under Investigation," "Archive" and "Help for Consumers." The "Under Investigation" tab "lists all HIPAA breaches reported within the last 24 months that are currently under investigation by the Office for Civil Rights." On October 28, 2026, it showed 757 entries, the newest filed October 5, 2026.³⁵ Older reports and closed investigations sit in the Archive, so a complete history of any organization requires searching both tabs.

Each entry has the same columns: name of covered entity, state, covered entity type, individuals affected, breach submission date, type of breach, location of breached information, whether a business associate was present, and a web description (usually filled in only for archived, resolved cases). All of it can be exported as Excel, CSV, PDF or XML.

How to read an entry

1. Name. The name is the covered entity that filed, not always the organization where the breach happened. A breach at a billing vendor may appear under each hospital that used it, or once under the vendor if notice was delegated, as Change Healthcare's was.
2. Business associate present. "Yes" means a vendor was involved. Searching for the same week across several entries often reveals one vendor behind many filings.
3. Individuals affected. Treat 500 and 501 with suspicion; they are often placeholders. The number can rise later through an addendum, so note the date you read it.
4. Breach submission date. This is the date the report reached OCR, not the date of the breach or of discovery. The gap between the incident (reported in news coverage or the notice letter) and the submission date is often the story.
5. Type and location. "Hacking/IT Incident" with "Network Server" is the common ransomware signature. "Unauthorized Access/Disclosure" with "Email" often means a misdirected or compromised mailbox. "Theft" with "Laptop" is the unencrypted device case.
6. Web description. For resolved cases, OCR's short summary often states what the organization did after the breach and whether OCR found violations, sometimes with technical assistance only.

What the portal does not tell you

• Breaches under 500. They are reported in annual logs and not posted. In 2024 there were 74,299 such reports affecting about 340,618 people, all invisible on the public list.⁶
• Non-HIPAA entities. Apps, wearable makers and other companies outside HIPAA report to the FTC, if anywhere, not to this list.
• What was taken, and how. The columns are categories. The details are in the notice letter, state attorney general filings and court records.
• Whether OCR found a violation. Being on the list does not mean the organization broke the rules. In 2024, OCR opened 730 compliance reviews, 665 of them from breach reports, and reported 22 resolutions by resolution agreement or civil money penalty, totaling $9,944,612.³⁶ Settlements and penalties are listed separately on OCR's resolution agreements page.²⁸
• Final numbers for recent years. Counts change as addenda arrive, so yearly totals from the portal differ depending on when they were pulled.

The national numbers

OCR's report to Congress on breaches of unsecured PHI for calendar year 2024 is the most recent official yearly count. It reports 663 breach reports affecting 500 or more people, 9 percent fewer than in 2023, which together affected about 242,908,056 individuals. Hacking and IT incidents accounted for 534 reports (81 percent) and 241,582,022 individuals (99 percent). Network servers were the location in 418 reports (63 percent) affecting 238,484,036 individuals (98 percent). Business associates were involved in 106 reports (16 percent) affecting 206,921,071 individuals (85 percent).⁶

OCR has not yet published a report to Congress for 2025. Trade press counts give a sense of the trend. HIPAA Journal's 2025 report, published February 13, 2026, counted 710 breaches of 500 or more reported in 2025, affecting at least 61,556,256 people, with totals rising as entities later revised their counts.³⁹ For 2026 through July 31, HIPAA Journal counted 67,400,422 people affected, with 86 percent of breaches (414) classed as hacking or IT incidents; the largest July filing, DentaQuest, involved about 15 million people.⁴⁰ These are secondary counts from the portal and will move as entries are updated.

The FTC Health Breach Notification Rule for apps outside HIPAA

Who the FTC rule covers

HITECH section 13407 gave the Federal Trade Commission a parallel job for consumer health records that HIPAA does not reach. The FTC's Health Breach Notification Rule, 16 CFR Part 318, applies to vendors of personal health records, "PHR related entities" that interact with them, and third-party service providers that serve them. HIPAA covered entities and business associates acting in that role are excluded. The FTC amended the rule in a final rule published May 30, 2024 (89 FR 47028), effective July 29, 2024.⁸ The amendments did three main things:

• They made clear that health apps and similar technologies are covered, so that many consumer health and wellness apps are vendors of personal health records under the rule.
• They made clear that a "breach of security" includes an unauthorized disclosure, such as an app sharing users' health data with advertising platforms without authorization, and not only a hack or theft.
• They expanded the allowed electronic methods of notice and the required contents of a notice.

The FTC cited two enforcement cases in the rule: GoodRx, which paid a $1.5 million civil penalty, and Easy Healthcare, maker of the Premom ovulation app, which paid $100,000. Both involved sharing health information with third parties rather than an outside attack.⁸

How the FTC rule compares with HIPAA's

Sources for the FTC column: 16 CFR 318.4 and 318.5 as amended, read October 28, 2026.⁴¹⁴² The practical lesson for a clinic is that HIPAA applies to the clinic's own patient portal and to the vendor that runs it under a business associate agreement, while a symptom-tracking app the patient downloaded from an app store, with no contract with the clinic, falls under the FTC rule if it falls under any federal breach rule at all. A patient complaint about a health app goes to the FTC, not OCR.

Idaho: state law runs alongside HIPAA

What Idaho Code 28-51-104 to 28-51-107 requires

HIPAA does not displace state breach laws that are more protective or that cover different data, and every state now has one. Course 69 covers all 50 in Breach Notification Laws in All 50 States, and Idaho's privacy laws in depth in Idaho Privacy Law Up Close. Here is only what a health care organization in Idaho needs to know about how the two run together.

• Different data. Idaho's law, in Idaho Code 28-51-104, covers "personal information": a first name or first initial and last name together with a Social Security number, a driver's license or Idaho identification card number, or an account, credit or debit card number with any required security code or password, when either the name or the data elements are not encrypted. Medical information is not a listed element. A "breach of the security of the system" is the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality or integrity of personal information.²⁶
• Different timing words. Under 28-51-105, a city, county or state agency, individual or commercial entity that conducts business in Idaho and owns or licenses such data must conduct, in good faith, a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused. If the investigation finds that misuse has occurred or is reasonably likely, notice to the affected Idaho residents must be made "in the most expedient time possible and without unreasonable delay." Public agencies must also notify the Idaho Attorney General within 24 hours of discovering a breach. A law enforcement delay is allowed.⁹
• A deemed-compliance clause. Under 28-51-106, an entity that maintains its own notice procedures as part of an information security policy, consistent with the statute's timing, or that is regulated and follows the procedures of its primary or functional state or federal regulator, is deemed to comply. The statute does not name HIPAA.⁴³
• Enforcement. Under 28-51-107, the primary regulator may bring a civil action, and an entity that intentionally fails to give notice may be fined up to $25,000 per breach.⁴⁴

How these fit together is a matter of interpretation, not a settled rule, and this lesson labels it that way. A clinic breach that involves only diagnoses and appointment data is a HIPAA breach but likely not an Idaho breach. A clinic breach that exposes names with Social Security numbers can trigger both. HIPAA's 60-day outer limit does not override Idaho's "most expedient time possible" standard, so a clinic should not assume that a notice timed for day 59 satisfies Idaho. Whether 28-51-106 deems a HIPAA-compliant notice to satisfy Idaho's statute has not been decided by an Idaho court that this lesson found. A county hospital or a public health district is a public agency and has the 24-hour Attorney General notice duty on top of everything else. HITECH also allows a state attorney general to bring a civil action in federal court to enforce HIPAA for state residents, with damages of up to $100 per violation and $25,000 per calendar year for violations of an identical requirement, after written notice to HHS.⁴⁵

The Idaho Attorney General posts the breach notices it receives on its consumer protection site.⁴⁶ That list is a useful cross-check against the HHS portal: it shows the Idaho filings, sometimes with copies of the letters, including breaches under 500 that HHS does not post.

Idaho health breaches on the record

The cases below are stated as their sources report them. Counts can change as organizations update filings, so check the current HHS portal, the Idaho Attorney General's list and the organization's notice letter before relying on a number.

Two more data points: HIPAA Journal counted 4 large breaches affecting 154,525 Idahoans in 2025, and the Idaho Attorney General's list shows that the South Central Public Health District filed a notice on December 11, 2025, without details this lesson could confirm.³⁹⁴⁶ Weiser's timeline shows a problem common to ransomware cases: the incident was identified in September 2024, and the file review that identified who was affected took until April 2025. Under the 2009 rule's reading, the HIPAA clock runs from the incident's discovery, not the end of the review, which is why many organizations now send an early notice describing the incident and follow it with individual letters, and why OCR's Change Healthcare FAQ says portal postings are amended as counts change.¹²⁷

Where this lesson links instead of repeating

• Health Privacy: HIPAA and Beyond (course 69, lesson 3): the overview of HIPAA, patient rights and health data outside HIPAA.
• Breach Notification Laws in All 50 States (course 69, lesson 9): state-by-state definitions, deadlines and attorney general notice rules.
• Idaho Privacy Law Up Close (course 69, lesson 10): Idaho Code Title 28, Chapter 51 and other Idaho privacy laws in detail.
• Detection, Incident Response and Notification (course 73, lesson 11): building the incident response program.
• When Something Goes Wrong (course 72, lesson 10): the first hours of an incident for a small business.
• In this module: who HIPAA covers, the Security Rule, the risk analysis, business associates, enforcement and real cases and a small clinic walkthrough.

Common mistakes, from real cases

1. Treating day 60 as the deadline instead of the ceiling. Presence Health discovered missing operating room schedules on October 22, 2013, and notice to patients went out 104 days later (media notice, 106 days). The $475,000 settlement in January 2017 was OCR's first for untimely breach notice.³¹ The rule's first test is "without unreasonable delay."
2. Waiting for the investigation to finish. The 2009 rule says the clock "begins when the incident is first known, not when the investigation of the incident is complete."¹² Long file reviews after ransomware, like Weiser Memorial's seven months, are common; the notice plan has to account for them.⁴⁸
3. Believing encryption was on when it was not. Lifespan had judged encryption reasonable and appropriate for laptops but had not deployed it on the stolen machine. A stolen unencrypted laptop turned into a breach of 20,431 records and a $1,040,000 settlement.²⁴
4. Assuming ransomware is an availability problem, not a breach. Since July 2016, OCR has said ransomware encryption of PHI is presumed a breach unless the four-factor test shows a low probability of compromise.²³ OCR's ransomware settlements through 2026, including OSF HealthCare's $552,250 in July 2026, show the agency follows through.³⁰
5. Letting the mailing itself disclose PHI. Notices and other member mailings can create new breaches. Aetna's $1,000,000 settlement, announced October 28, 2020, covered a July 2017 mailing in which the words "HIV medication" showed through envelope windows for 11,887 members, and a September 2017 mailing whose envelopes showed the name of an atrial fibrillation research study to 1,600 members.⁵¹ Breach letters need the same care: plain envelopes, no diagnosis on the outside, a check of the mail merge before it runs.
6. Never filing the annual log. Small breaches under 500 still have to be reported to HHS within 60 days after the end of the year. A practice that handled 12 misdirected letters correctly with patients but never filed the log has still violated 164.408(c).⁵
7. Accepting a 60-day business associate reporting window. If the vendor is your agent, its discovery is yours, and a vendor that takes 60 days leaves you none. Contract for prompt reporting.
8. Letting a placeholder number stand. A filing of 500 that is never updated misleads the public and OCR. Change Healthcare's own count went from a placeholder of 500 to about 192.7 million over a year, through amendments.⁷
9. Not reviewing access logs. Snooping cases often run for months because nobody looks. Reasonable diligence can move the discovery date back to when routine log review would have caught it.
10. Writing "low risk" without the analysis. Under 164.414, the organization carries the burden. A conclusion without facts for each of the four factors will not hold up.²⁵

Questions people ask

Do we have to do the four-factor risk assessment every time?

No. The assessment is how an organization overcomes the presumption of breach. An organization may skip it and notify. If it wants to conclude that no notice is required, it must do the assessment and document it.¹

We emailed one patient's lab results to another patient. Is that a breach?

Almost always it is an impermissible disclosure, so the presumption applies. None of the three exceptions fit a stranger outside the organization. If the recipient confirms in writing that the message was deleted unread or deleted and not shared, and the content was limited, the four-factor test might support a low probability, but many organizations notify in this situation because the recipient did see it and the patient deserves to know. Either way, it goes in the annual log if notice is given, and the assessment goes in the file.

Is a breach of encrypted email or an encrypted backup reportable?

If the encryption met HHS guidance and the key was not compromised, the PHI was secured and the breach rule does not apply.² If the attacker got the key, the password, or access while the data was decrypted (for example, inside a compromised user account), the PHI was unsecured at that moment.²³

Do we send HHS the names of the patients?

No. The HHS report describes the breach, its size, type and location, the kinds of PHI, safeguards, notices and actions taken. It does not ask for the list of individuals.³⁴ OCR may request records during an investigation.

Does HIPAA require us to offer credit monitoring?

No. The rule requires the letter to describe steps individuals should take and what the organization is doing to mitigate harm. Credit monitoring is common where Social Security or financial numbers were involved, and OCR's portal form lists free credit monitoring as one of the actions it asks about, but the rule does not mandate it.³³⁴ State laws and settlements sometimes do.

What if the affected patient has died?

If the organization knows the patient has died and has the address of the next of kin or personal representative, the letter goes to that person by first-class mail. Substitute notice is not required if that address is unknown.³

Our name is on the HHS portal because of a vendor's breach. Does that mean we broke the rules?

No. The portal lists reported breaches, not findings. OCR investigates every report of 500 or more, and the investigation decides whether there was a violation.³⁵ The answer will turn on your own compliance: your risk analysis, your business associate agreement and how you handled notice.

The police asked us to wait. How long can we?

If the request is in writing and specifies a time, for that time. If it is oral, document who asked and when, and wait no more than 30 days unless a written request arrives.³³

Hard questions

Does the presumption of breach produce too many notices?

The case that it does: Patients receive letters about minor events, learn to ignore them and pay less attention when a serious breach arrives. Small practices spend money and staff time on letters about a single misdirected fax. Under the 2009 harm standard, organizations could focus notice on incidents that could actually hurt people.

The case that it does not: The organization that lost the data has a conflict of interest in deciding whether patients should know. A presumption with a documented exception is more objective than a harm judgment, which is the reason HHS gave in 2013 for replacing the harm threshold with "a more objective standard."¹³ Patients cannot protect themselves from risks they are not told about.

What the evidence shows: The numbers are dominated by a few very large hacking incidents, not by small mistakes: in 2024, hacking accounted for 99 percent of people affected in large breaches, and the 74,299 small-breach reports together affected about 340,618 people.⁶ Small-breach notices are numerous, but their total reach is small. No official study has measured whether patients tune out breach letters.

Is 60 days too long?

The case for shorter: Stolen data is used quickly. Other regimes move faster: since 2023 the SEC has required public companies to disclose material cybersecurity incidents within four business days of determining that an incident is material,⁵² and some state breach laws set fixed day counts shorter than 60 (course 69's 50-state lesson compares them). A fixed short deadline would remove the temptation to treat 60 days as the target.

The case for keeping it: Health care breaches often need weeks of forensic work and file review to learn who was affected and what to tell them. Faster notice may be less accurate, and inaccurate notices create confusion and repeat mailings. The "without unreasonable delay" standard already requires earlier notice when it is possible.

What the evidence shows: Large ransomware cases routinely take longer than 60 days to identify everyone: Change Healthcare's count was still rising more than a year after the attack, and Weiser Memorial's file review took seven months.⁷⁴⁸ Organizations deal with that by giving early general notice and following with individual letters, a practice the rule allows through notice "in one or more mailings as information is available."³ Enforcement of the deadline has been rare; Presence Health in 2017 was the first OCR settlement over late notice.³¹

Should HHS make encryption and multifactor authentication mandatory?

The case for a mandate: Encryption is today an "addressable" specification, and the breach rule rewards it only after the fact. Many of the largest breaches started with a stolen password on a system without multifactor authentication, including, by UnitedHealth Group's own account, the Change Healthcare attack.³⁷ HHS's January 6, 2025 proposed rule (90 FR 898) would require encryption of ePHI at rest and in transit and multifactor authentication, with limited exceptions.⁵³

The case against a mandate: Small and rural providers, older medical devices and some clinical workflows cannot easily meet a hard rule, and the cost estimates for the whole proposal are large (HHS's own regulatory impact analysis, as widely reported, put it at about $9.3 billion in the first year). A flexible, risk-based rule lets each organization put money where its risks are.

What the evidence shows: The breach rule's safe harbor already makes encryption the single most effective way to avoid notice for lost or stolen devices; the Lifespan case shows the cost of not using it.²⁴ As of October 28, 2026, the proposal is not final. HHS's regulatory agenda lists it as a long-term action with final action projected for July 2027.⁵⁴ Lesson 3 covers the proposal and the comments on both sides.

Is delegated notice good for patients?

The case for it: When one vendor serves thousands of providers, a single notice from the vendor avoids thousands of conflicting letters and lets the organization that knows the facts write them. OCR allowed this approach for Change Healthcare.⁷

The case against it: Patients get a letter from a company they never chose, about a provider they do know, and may treat it as a scam. The provider's name may not appear on the HHS portal, so the public record does not show which practices' patients were affected.

What the evidence shows: OCR's FAQ makes clear that delegation does not remove the covered entity's responsibility to make sure notice happens.⁷ There is no public study of how patients responded to the Change letters.

Where to go next

• HHS OCR Breach Portal: Free, official. Where covered entities file breach reports and where anyone can search and export the public list of breaches of 500 or more. Use the Under Investigation and Archive tabs and export to CSV for analysis.
• HHS Breach Notification Rule overview: Free, official. HHS's plain-language summary of the rule with links to the regulation text and guidance. A good page to bookmark for staff training.
• HHS guidance on rendering PHI unusable: Free, official. The encryption and destruction methods that create the safe harbor. Give it to your IT provider and check device encryption against it.
• OCR Fact Sheet: Ransomware and HIPAA: Free, official. OCR's 2016 explanation of why ransomware is presumed a breach and how to assess it. Useful for incident response tabletop planning.
• FTC Health Breach Notification Rule resources: Free, official. The 2024 final rule with the FTC's explanation of coverage for health apps. For app developers and digital health vendors not covered by HIPAA.
• Idaho Attorney General security breach notices: Free, official. The list of breach notices filed with the Idaho Attorney General, including small breaches not on the HHS portal. Useful for reporters and for checking Idaho filings.
• HHS 405(d) Knowledge on Demand: Free HHS training videos on the five main health care cyber threats, including ransomware, for clinical staff and security teams.

Still being checked (8 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• HHS's estimated cost of the proposed Security Rule update (about $9.3 billion in the first year) is stated as widely reported; the HHS press release did not load on Oct. 28, 2026.
• Kootenai Health's count (464,088) comes from a Maine Attorney General filing as reported by SecurityWeek; the HHS portal entry was not separately confirmed.
• South Central Public Health District's Dec. 11, 2025 filing with the Idaho Attorney General is confirmed on the AG list, but its details were not.
• No Idaho Department of Health and Welfare breach in 2024 to 2026 was found; the 2023 incident is from KTVB reporting.
• The HHS breach portal form questions are described from a hosted copy (UNC School of Government); the live form may differ.
• Whether HHS breach guidance will be updated for NIST SP 800-88 Rev. 2 and FIPS 140-3 is not known; the guidance page still names the older documents.
• No OCR enforcement action against Change Healthcare had been announced as of Oct. 28, 2026 (absence of evidence).
• No Idaho court decision on whether Idaho Code 28-51-106 deems a HIPAA-compliant notice to satisfy Idaho law was found.

Last verified October 28, 2026. General education, not legal, compliance or medical advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. 45 CFR 164.402, Definitions (breach, its exceptions, the presumption and four factors, and unsecured protected health information), as amended by the Omnibus Rule, 78 FR 5566 (Jan. 25, 2013); Cornell LII copy of current text (read Oct. 28, 2026). Read it online. ↩
2. U.S. Department of Health and Human Services, Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, content last reviewed July 26, 2013 (read Oct. 28, 2026). Read it online. ↩
3. 45 CFR 164.404, Notification to individuals, including (a)(2) discovery, (b) timeliness, (c) content and (d) methods and substitute notice, as amended by the Omnibus Rule (2013); Cornell LII copy of current text (read Oct. 28, 2026). Read it online. ↩
4. 45 CFR 164.406, Notification to the media, as amended by the Omnibus Rule (2013); Cornell LII copy of current text (read Oct. 28, 2026). Read it online. ↩
5. 45 CFR 164.408, Notification to the Secretary, including (b) breaches of 500 or more and (c) breaches of fewer than 500, as amended by the Omnibus Rule (2013); Cornell LII copy of current text (read Oct. 28, 2026). Read it online. ↩
6. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (663 reports of 500 or more affecting about 242,908,056 individuals; 74,299 reports under 500 affecting about 340,618; hacking 534 reports and 241,582,022 individuals; network server 418 and 238,484,036; business associates 106 and 206,921,071; largest about 192,000,000) (read Oct. 28, 2026). Read it online. ↩
7. HHS Office for Civil Rights, Change Healthcare Cybersecurity Incident Frequently Asked Questions, updated as of March 14, 2025, content last reviewed Aug. 13, 2025 (filing July 19, 2024 with 500 as placeholder; about 100 million notices by Oct. 22, 2024; about 130 million notices and about 190 million impacted by Jan. 24, 2025; about 192.7 million impacted as of July 31, 2025; delegation of notification) (read Oct. 28, 2026). Read it online. ↩
8. Federal Trade Commission, "Health Breach Notification Rule," final rule, 89 FR 47028 (May 30, 2024), effective July 29, 2024 (citing the GoodRx $1.5 million and Easy Healthcare (Premom) $100,000 civil penalties) (read Oct. 28, 2026). Read it online. ↩
9. Idaho Code 28-51-105, Disclosure of breach of security of computerized personal information (current text, Idaho Legislature) (read Oct. 28, 2026). Read it online. ↩
10. Health Information Technology for Economic and Clinical Health Act, section 13402, Notification in the case of breach, Pub. L. 111-5 (Feb. 17, 2009), 42 U.S.C. 17932; Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
11. HHS, "Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals for Purposes of the Breach Notification Requirements under Section 13402 of Title XIII," 74 FR 19006 (Apr. 27, 2009) (read Oct. 28, 2026). Read it online. ↩
12. HHS, "Breach Notification for Unsecured Protected Health Information," interim final rule, 74 FR 42740 (Aug. 24, 2009), effective Sept. 23, 2009 (harm standard; limited data set exclusion; discovery and 60-day discussion; definition of jurisdiction for media notice) (read Oct. 28, 2026). Read it online. ↩
13. HHS, "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the HITECH Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules" (the Omnibus Rule), 78 FR 5566 (Jan. 25, 2013), effective Mar. 26, 2013, compliance Sept. 23, 2013 (read Oct. 28, 2026). Read it online. ↩
14. HHS, "Confidentiality of Substance Use Disorder (SUD) Patient Records," final rule, 89 FR 12472 (Feb. 16, 2024), effective Apr. 16, 2024, compliance date Feb. 16, 2026, implementing CARES Act section 3221 (read Oct. 28, 2026). Read it online. ↩
15. HHS Office for Civil Rights, breach portal, "Notice to the Secretary of HHS Breach of Unsecured Part 2 Records," Part 2 Cases Currently Under Investigation (showing no records on the date read) (read Oct. 28, 2026). Read it online. ↩
16. 45 CFR Part 164, Subpart D, Notification in the Case of Breach of Unsecured Protected Health Information, sections 164.400 to 164.414, eCFR current text (read Oct. 28, 2026). Read it online. ↩
17. 45 CFR 164.530, Administrative requirements, including (b) training, (e) sanctions, (f) mitigation and (j) documentation retained six years, as amended by the Omnibus Rule (2013); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
18. 45 CFR 164.308(a)(6), Security incident procedures (Security Rule, 68 FR 8334 (Feb. 20, 2003), as amended 2013); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
19. 45 CFR 160.103, Definitions (protected health information, workforce, business associate), as amended by the Omnibus Rule (2013); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
20. 45 CFR 164.304, Definitions (encryption, security incident), Security Rule as amended 2013; Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
21. National Institute of Standards and Technology, SP 800-88 Rev. 2, Guidelines for Media Sanitization, final, Sept. 26, 2025, superseding Rev. 1 (Dec. 17, 2014) (read Oct. 28, 2026). Read it online. ↩
22. NIST Computer Security Resource Center, FIPS 140-3 Transition Effort (FIPS 140-2 validations moved to the historical list in September 2026; CMVP supports continued use of those modules in existing systems) (read Oct. 28, 2026). Read it online. ↩
23. HHS Office for Civil Rights, Fact Sheet: Ransomware and HIPAA, July 11, 2016 (read Oct. 28, 2026). Read it online. ↩
24. HHS press release, "Lifespan Pays $1,040,000 to OCR to Settle Unencrypted Stolen Laptop Breach," July 27, 2020 (read Oct. 28, 2026). Read it online. ↩
25. 45 CFR 164.414, Burden of proof, as amended by the Omnibus Rule (2013); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
26. Idaho Code 28-51-104, Definitions (breach of the security of the system; personal information) (current text, Idaho Legislature) (read Oct. 28, 2026). Read it online. ↩
27. HIPAA Journal, report on the Eastern Idaho Public Health insider data breach, Jan. 9, 2025 (759 people on the HHS portal); see also the agency's press release at eiph.id.gov (read Oct. 28, 2026). Read it online. ↩
28. HHS Office for Civil Rights, Resolution Agreements and Civil Money Penalties list (Montefiore Medical Center, $4,750,000, Feb. 6, 2024) (read Oct. 28, 2026). Read it online. ↩
29. HHS press release announcing four ransomware settlements, Apr. 23, 2026 (19 completed ransomware investigations to date; hacking and ransomware the most frequent type of large breach) (read Oct. 28, 2026). Read it online. ↩
30. HHS press release on the ransomware settlement with OSF HealthCare System ($552,250, 21st ransomware enforcement action), July 29, 2026 (read Oct. 28, 2026). Read it online. ↩
31. HHS Office for Civil Rights, Resolution Agreement and Corrective Action Plan with Presence Health Network, announced Jan. 9, 2017 ($475,000; discovery Oct. 22, 2013; 836 individuals; OCR notified Jan. 31, 2014, 101 days after discovery; individuals notified Feb. 3, 2014, 104 days after discovery; media notified Feb. 5, 2014, 106 days after discovery; two-year corrective action plan). Content of the schedules and the Joliet location as reported by Davis Wright Tremaine, "Time Waits for No One," January 2017 (read Oct. 28, 2026). Read it online. ↩
32. 45 CFR 164.410, Notification by a business associate, as amended by the Omnibus Rule (2013); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
33. 45 CFR 164.412, Law enforcement delay; Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
34. HHS Office for Civil Rights, breach portal reporting questions (General, Contact, Breach, Notice of Breach and Actions Taken, and Attestation screens), copy hosted by the UNC School of Government; the live form is at ocrportal.hhs.gov and may have changed (read Oct. 28, 2026). Read it online. ↩
35. HHS Office for Civil Rights, breach portal, "Cases Currently Under Investigation" (section 13402(e)(4) statement; breaches reported within the last 24 months under investigation; 757 entries displayed on the date read; tabs Under Investigation, Archive, Help for Consumers); portal home page states OCR investigates all breaches affecting 500 or more (read Oct. 28, 2026). Read it online. ↩
36. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024 (730 compliance reviews initiated, 665 from breach reports; 22 resolutions totaling $9,944,612) (read Oct. 28, 2026). Read it online. ↩
37. Arielle Waldman, "Change Healthcare breached via Citrix portal with no MFA," TechTarget, Apr. 30, 2024, reporting the prepared testimony of UnitedHealth Group CEO Andrew Witty for the May 1, 2024 House Energy and Commerce Subcommittee on Oversight and Investigations hearing (read Oct. 28, 2026). Read it online. ↩
38. HHS Office for Civil Rights, Dear Colleague letter on the Change Healthcare cyberattack, Mar. 13, 2024 (read Oct. 28, 2026). Read it online. ↩
39. HIPAA Journal, 2025 Healthcare Data Breach Report, Feb. 13, 2026 (710 breaches of 500 or more; at least 61,556,256 individuals; 4 large breaches affecting 154,525 Idahoans); secondary source, counts change as filings are amended (read Oct. 28, 2026). Read it online. ↩
40. HIPAA Journal, July 2026 Healthcare Data Breach Report, Oct. 15, 2026 (67,400,422 individuals affected in 2026 through July 31; 414 hacking incidents, 86 percent; DentaQuest about 15,000,000; Boundary Regional Community Health Center (Kaniksu Community Health) 88,000 via business associate Aesto Health); secondary source (read Oct. 28, 2026). Read it online. ↩
41. 16 CFR 318.4, Timeliness of notification, as amended by 89 FR 47028 (May 30, 2024); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
42. 16 CFR 318.5, Methods of notice, including (b) notice to media, as amended by 89 FR 47028 (May 30, 2024); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
43. Idaho Code 28-51-106, Procedures deemed in compliance with security breach requirements (current text, Idaho Legislature) (read Oct. 28, 2026). Read it online. ↩
44. Idaho Code 28-51-107, Violations (current text, Idaho Legislature) (read Oct. 28, 2026). Read it online. ↩
45. 42 U.S.C. 1320d-5(d), Enforcement by State attorneys general (added by HITECH section 13410(e)); Cornell LII copy (read Oct. 28, 2026). Read it online. ↩
46. Idaho Office of the Attorney General, Consumer Protection, Security Breaches notice list (Minidoka Memorial Hospital filings Aug. 6, 2026 and Sept. 28, 2026; South Central Public Health District filing Dec. 11, 2025) (read Oct. 28, 2026). Read it online. ↩
47. SecurityWeek, report on the Kootenai Health ransomware attack, 2024 (464,088 people per Maine Attorney General filing; exfiltration around Feb. 22, 2024, identified Mar. 2, 2024; 3AM group claim); secondary source (read Oct. 28, 2026). Read it online. ↩
48. HIPAA Journal, report on the Weiser Memorial Hospital data breach, May 15, 2025 (59,990 people; activity identified Sept. 4, 2024; review concluded Apr. 21, 2025); secondary source (read Oct. 28, 2026). Read it online. ↩
49. HIPAA Journal, report on the Minidoka Memorial Hospital cyberattack, Apr. 22, 2026 (Easter morning 2026 attack; hospital statement Apr. 17, 2026; up to 22,000 patients reported to OCR; Blackwater claim); secondary source (read Oct. 28, 2026). Read it online. ↩
50. KTVB (Boise), report on the Idaho Department of Health and Welfare data breach, 2023 (Apr. 18, 2023 access to a Medicaid provider's payment account; 2,501 Medicaid members; notices mailed June 9, 2023); secondary source (read Oct. 28, 2026). Read it online. ↩
51. HHS press release on Aetna's $1,000,000 settlement of three HIPAA breaches, Oct. 28, 2020 (read Oct. 28, 2026). Read it online. ↩
52. Mintz, "SEC Adopts Final Cybersecurity Rules for Public Companies," Aug. 1, 2023, describing Form 8-K Item 1.05 (disclosure within four business days after a materiality determination), adopted July 26, 2023 (read Oct. 28, 2026). Read it online. ↩
53. HHS, "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information," notice of proposed rulemaking, 90 FR 898 (Jan. 6, 2025), RIN 0945-AA22; still a proposal on the date read (read Oct. 28, 2026). Read it online. ↩
54. Office of Information and Regulatory Affairs, Unified Agenda entry for RIN 0945-AA22 (2026 agenda): Long-Term Actions; final action projected 07/00/2027 (read Oct. 28, 2026). Read it online. ↩