A HIPAA breach notification response program is the set of procedures, worksheets and templates that a covered entity or business associate uses to decide whether an incident is a breach and to give the notices that subpart D of 45 CFR part 164 requires. Integral Healthcare Solutions (IHS) drafts that program with your privacy officer for organizations that have no written response procedure.
You and your counsel decide whether an impermissible use or disclosure is a breach, counsel approves the notice wording, and you send the notices. IHS does not take possession of protected health information or receive incident data. IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
When is an impermissible use or disclosure a breach?
Section 164.402 defines a breach as the acquisition, access, use or disclosure of protected health information in a manner not permitted under subpart E of part 164 that compromises the security or privacy of the information. Sources (eCFR text of October 29, 2026, opened November 2, 2026): 164.404, 164.406, 164.408, 164.410, 164.412, 164.414.
Three exclusions: an unintentional acquisition, access or use by a workforce member or person acting under the authority of a covered entity or business associate, if made in good faith and within the scope of authority and not followed by a further use or disclosure not permitted under subpart E; an inadvertent disclosure between persons authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, if the information is not further used or disclosed in a manner not permitted under subpart E; and a disclosure where the entity has a good faith belief that the unauthorized recipient would not reasonably have been able to retain the information.
Outside those, an impermissible acquisition, access, use or disclosure is presumed a breach unless the entity demonstrates a low probability of compromise based on a risk assessment of at least four factors: the nature and extent of the information, including identifiers and the likelihood of re-identification; who used it or received it; whether it was actually acquired or viewed; and the extent to which the risk has been mitigated.
The notice duties attach to a breach of unsecured protected health information, defined by reference to Secretary guidance under section 13402(h)(2) of Public Law 111-5, not described here.
Who must be notified, by when, and how?
| Duty | What the text says |
|---|---|
| Individuals, 164.404(a) and (b) | Notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used or disclosed because of the breach, without unreasonable delay and in no case later than 60 calendar days after discovery, except as provided in 164.412. Method, 164.404(d)(1): first-class mail to the last known address, or e-mail if the individual agrees and has not withdrawn agreement; for a deceased individual, to the next of kin or personal representative if the covered entity knows of the death and has that address. |
| Discovery date, 164.404(a)(2) | A breach is treated as discovered on the first day it is known to the covered entity or, by exercising reasonable diligence, would have been known. The entity is deemed to know of a breach that is known, or by reasonable diligence would have been known, to any workforce member or agent other than the person committing the breach, with agency determined under the federal common law of agency. |
| Media, 164.406 | For a breach involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving it, on the same timing rule as individual notice, including the 164.412 exception, with content that meets 164.404(c). |
| Secretary, 500 or more, 164.408(b) | Notify the Secretary of Health and Human Services (HHS) contemporaneously with the individual notice, except as provided in 164.412, in the manner specified on the HHS Web site. |
| Secretary, fewer than 500, 164.408(c) | Maintain a log or other documentation and, not later than 60 days after the end of each calendar year, notify the Secretary of breaches discovered during the preceding calendar year, in the manner specified on the HHS web site. |
| Business associate, 164.410 | Notify the covered entity following discovery, without unreasonable delay and in no case later than 60 calendar days after discovery, except as provided in 164.412, identifying each affected individual to the extent possible and giving other available information the covered entity must include in its notice, at the time or promptly after. |
| Law enforcement delay, 164.412 | If a law enforcement official states that a notification, notice or posting required under this subpart would impede a criminal investigation or cause damage to national security: for a written statement that specifies the time, delay for that time; for an oral statement, document it, including the official's identity, and delay temporarily and no longer than 30 days from the statement, unless a written statement that specifies the time is submitted during that time. |
The media threshold is more than 500 residents of a State or jurisdiction; the Secretary threshold is 500 or more individuals. In IHS's reading, those count different things, so a decision tree runs two tests.
What does the rule say about proof and records?
Section 164.414 says that in the event of a use or disclosure in violation of subpart E, the covered entity or business associate, as applicable, has the burden of demonstrating that all notifications were made as required by subpart D or that the use or disclosure did not constitute a breach. A covered entity must also comply with the administrative requirements of section 164.530(b), (d), (e), (g), (h), (i) and (j) for subpart D.
In IHS's reading, the burden is why a program needs a decision log of each determination, the factors weighed, the dates and the notices sent.
Who needs a response program and what triggers it?
Whether you are a covered entity or business associate is for your counsel. In IHS's reading, a suspected incident with no written procedure, a contract that requires a tested one, or a near miss that showed nobody knew who decides can start a build. A business associate may need a procedure for notifying its covered entity customers (section 164.410).
How IHS helps
IHS works in five steps: gap assessment against these sections, ownership mapping, drafting, a tabletop script and readiness support.
IHS drafts the response plan, intake and triage procedure, risk assessment worksheet, decision log, notice templates and letters (individual, substitute, media, business associate), a decision tree and calendar, and a tabletop scenario on a fictional incident. IHS works from your policies and process descriptions, never incident data.
You supply the facts of any real incident, counsel's determinations and approval, the sending of notices, and the toll-free number and web posting.
The real limit: IHS does not investigate incidents, decide reportability, send notices, or communicate with HHS, regulators or the media. IHS drafts; you and your counsel decide and send.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC.
What to have ready
- Any incident procedure, however informal, who decides today whether an incident is a breach, and your counsel's contact (section 164.402).
- How you record the day an incident became known to anyone whose knowledge counts: a workforce member or agent of a covered entity (paragraph 164.404(a)(2)), or an employee, officer or other agent of a business associate (paragraph 164.410(a)(2)).
- Your business associates and how each would tell you about an incident (section 164.410).
- How you would reach individuals, and whether you can post on your home page for 90 days (paragraphs 164.404(c) and (d)).
- How you would count residents of a State or jurisdiction and individuals against the two 500 thresholds (sections 164.406 and 164.408).
- Any log of past incidents (paragraph 164.408(c)).
If you want to start, the introductory call is free.
How it compares
This page covers the federal sections only; whether state law or another rule also applies is for your counsel. For prevention, see HIPAA security risk analysis. Section 164.530 is covered on the Privacy Rule compliance program page. After an incident, organizational recovery is separate work. See compliance services.
What does a HIPAA breach notification response program cost?
Government fees: the sections read set none and do not address penalties. Consulting fees: IHS does not publish a price for this work and scopes each engagement after a free introductory call. In IHS's reading, scope moves with the number of locations, systems and business associates, and whether a procedure and log already exist.
What this is not
- It is not legal advice or a determination that any event is a breach. IHS is a consulting firm, not a law firm.
- It is not incident investigation or notice delivery.
Frequently asked questions
What is a breach under HIPAA?
Section 164.402 defines it as the acquisition, access, use or disclosure of protected health information in a manner not permitted under subpart E of part 164 that compromises the security or privacy of the information. Outside three exclusions, an impermissible acquisition, access, use or disclosure is presumed a breach unless the entity demonstrates a low probability of compromise. You and your counsel decide.
What goes in the breach risk assessment?
At least four factors under section 164.402: the nature and extent of the information, including identifiers and the likelihood of re-identification; who used it or received it; whether it was actually acquired or viewed; and how far the risk is mitigated.
How soon must we notify individuals?
Without unreasonable delay and in no case later than 60 calendar days after discovery of a breach, except as provided in section 164.412 (paragraph 164.404(b)).
When do we tell the media and HHS?
Media: for a breach involving more than 500 residents of a State or jurisdiction (section 164.406). HHS: for 500 or more individuals, contemporaneously with the individual notice; for fewer than 500, a log or other documentation and notice not later than 60 days after the end of the calendar year, for breaches discovered that year (section 164.408). Section 164.412 applies by its terms to a notification, notice or posting required under subpart D, including each of these.
What must the notice to an individual say?
To the extent possible, paragraph 164.404(c) requires what happened, with the dates of the breach and of discovery if known; the types of information involved; steps individuals should take to protect themselves; what the covered entity is doing to investigate, mitigate harm and prevent further breaches; and contact procedures that include a toll-free telephone number, an e-mail address, a Web site or a postal address. It must be in plain language.
What if we lack current addresses?
When contact information is insufficient or out of date and precludes written notice, paragraph 164.404(d)(2) requires a substitute notice reasonably calculated to reach the individual. For fewer than 10 individuals it may be an alternative written notice, telephone or other means. For 10 or more it must be a 90-day conspicuous posting on the entity's Web site home page or conspicuous notice in major print or broadcast media where they likely reside, plus a toll-free number active at least 90 days. It is not required where the missing information is a next of kin's or personal representative's.
What does a business associate owe the covered entity?
Notice following discovery of a breach of unsecured protected health information, without unreasonable delay and in no case later than 60 calendar days after discovery, except as provided in section 164.412 (section 164.410). It identifies each affected individual, to the extent possible.
Does the consultant decide whether our incident is a breach?
No. That is for you and your counsel. Integral Healthcare Solutions does not investigate incidents, receive incident data, send notices, or communicate with HHS, regulators or the media.