HIPAA Data Breach Timeline: What Small Practices Must Do After Discovering a Breach

Your practice has investigated an incident and determined that a breach of unsecured protected health information occurred.

Now the question changes.

It is no longer simply:

What happened?

It becomes:

Who do we need to notify, how quickly do we need to notify them, and what do we need to document along the way?

This is where the HIPAA breach timeline starts to matter.

And one of the most important things to understand is that the familiar “60-day rule” does not mean you have 60 days to wait before doing anything.

HIPAA generally requires affected individuals to be notified without unreasonable delay and no later than 60 calendar days after discovery of the breach.

That distinction matters.

A small practice may need to identify affected patients, determine what information was involved, prepare notices, coordinate with a vendor or business associate, continue investigating, report to HHS, and possibly notify the media.

And all of that may be happening while the clock is already running.

If you are still trying to determine whether an event is actually a HIPAA breach, start with HIPAA Incident vs. Breach: What's the Difference?

If you have just discovered a cybersecurity incident and are still trying to contain it and figure out what happened, see What Should a Small Medical Practice Do Immediately After Discovering a Cybersecurity Incident?

This guide starts one step later:

“You have determined that a breach occurred. What happens next?”

When does the HIPAA breach notification clock start?

This is where many practices can get tripped up.

It is tempting to think:

We will finish investigating everything first, decide exactly how many people were affected, and then the 60-day clock starts.

That is not how the rule works.

Under the HIPAA Breach Notification Rule, discovery is tied to when the breach is known—or, through reasonable diligence, would have been known.

HHS has specifically cautioned that the reporting period begins when the incident is first known, not simply when the investigation is complete.

That does not mean you should send incomplete or inaccurate notices the moment someone reports a suspicious event.

You still need to investigate.

You still need to determine whether a breach actually occurred.

You still need to identify affected individuals and understand what information was involved.

But once a breach has been discovered, you should not assume that completing the rest of the investigation gives you a fresh 60-day window.

A useful way to think about it is:

The investigation and the notification timeline can run at the same time.

Day 0: Document the discovery date

Once the organization has determined that a breach occurred, document that point clearly.

You should be able to answer:

• When was the breach discovered?
• Who became aware of it?
• When did the organization determine that the incident involved unsecured PHI?
• What information is known so far?
• What remains unknown?
• How many individuals are currently believed to be affected?
• Is that number final or still being investigated?
• Was a business associate involved?
• What mitigation or corrective action has already occurred?

Do not rely on someone remembering this six weeks later.

The discovery date can affect multiple notification obligations, so it belongs in the incident record.

And if the facts change later, document that too.

An incident file should tell the story of what the practice knew, when it knew it, and what it did next.

Immediately: Keep investigating and mitigating

Determining that a breach occurred does not mean the investigation is finished.

You may still need to determine:

• exactly which patients were affected;
• what types of PHI were involved;
• whether Social Security numbers, financial information, diagnoses, insurance information, or other sensitive data were included;
• whether information was actually viewed or acquired;
• how long unauthorized access existed;
• whether other systems or accounts were affected;
• whether a vendor has additional evidence;
• whether the breach has been fully contained; and
• whether additional individuals may need to be added to the notification population.

At the same time, continue mitigating the underlying problem.

That could mean disabling compromised credentials, correcting access permissions, patching a vulnerability, changing a workflow, retraining staff, working with a vendor, or implementing other corrective action appropriate to the facts.

The breach determination does not end the response.

It changes the response.

As soon as reasonably possible: Identify affected individuals

Before you can notify people, you need to know who they are.

That sounds obvious, but this step can become surprisingly complicated.

Imagine that an employee email account was compromised.

You may know that the attacker had access to the mailbox for several days.

But you may still need to determine:

• which messages contained PHI;
• which patients were mentioned;
• whether attachments contained additional records;
• whether deleted or archived messages were accessible;
• whether the attacker actually opened particular messages; and
• whether other folders or connected services were affected.

Or suppose a spreadsheet containing patient information was exposed through a cloud folder.

You may need to determine which version of the file was exposed and which patients were included in it during the exposure period.

This is why breach response often becomes partly an information-management problem.

The goal is to identify, as accurately as reasonably possible, the people whose unsecured PHI was involved.

Prepare individual notifications without unnecessary delay

Once you know who needs to be notified, you need to prepare the notice itself.

HIPAA requires the notice to be written in plain language.

The notice generally needs to explain:

• what happened;
• when the breach occurred, if known;
• when it was discovered;
• what types of information were involved;
• what affected individuals can do to protect themselves;
• what the practice is doing to investigate, mitigate harm, and prevent further breaches; and
• how individuals can contact the practice for more information.

This does not need to read like a legal brief.

In fact, it should not.

A patient should be able to read the notice and understand:

No later than 60 calendar days: Notify affected individuals

This is the rule most people recognize.

For a breach requiring individual notification, the covered entity generally must notify affected individuals:

without unreasonable delay and no later than 60 calendar days after discovery of the breach.

The important phrase is not just:

60 calendar days.

It is:

without unreasonable delay.

The 60-day limit is an outside boundary.

It is not an instruction to wait until day 60.

If the practice knows who was affected, understands what information was involved, has completed the notice, and has no reasonable reason to delay, sitting on the letters until the deadline approaches can create a different problem.

A better mindset is:

Get the facts you need, prepare an accurate notice, and send it as soon as reasonably possible.

HIPAA breach timeline at a glance

For a small practice, the sequence generally looks like this:

That last point causes a lot of confusion, so it deserves a closer look.

What if fewer than 500 people were affected?

A breach affecting fewer than 500 individuals does not disappear from HHS reporting requirements.

It simply follows a different reporting schedule.

HHS allows these smaller breaches to be reported annually.

The report to HHS is due within 60 days after the end of the calendar year in which the breach was discovered. You do not have to wait until the end of the year—you can report it earlier if you choose.

But this annual HHS schedule applies to the report to the Secretary.

It does not mean you can wait until the end of the year to notify affected patients.

Individual notification still follows the general rule:

without unreasonable delay and no later than 60 calendar days after discovery.

So imagine your practice discovers a breach affecting 27 patients in June.

You do not get to wait until the following February or March to tell those 27 patients simply because HHS allows the smaller breach to be included in the annual reporting cycle.

The two obligations run on different schedules.

What if 500 or more people were affected?

For breaches affecting 500 or more individuals, HHS reporting becomes much more immediate.

The covered entity must notify HHS:

without unreasonable delay and no later than 60 calendar days from discovery of the breach.

This means a larger breach can create multiple deadlines running at the same time:

• affected individuals;
• HHS; and
• potentially the media.

For a small practice, a breach affecting 500 people may sound enormous.

But it does not take a hospital-sized organization to reach that number.

A single compromised email account, exported patient list, billing file, cloud folder, stolen device, or vendor incident could affect hundreds or thousands of records.

The size of the practice does not determine the reporting threshold.

The number of affected individuals does.

When is media notification required?

HIPAA also includes a media-notification requirement for certain larger breaches.

If a breach affects more than 500 residents of a state or jurisdiction, notice to prominent media outlets serving that area may be required.

That threshold is worth reading carefully.

The HHS reporting threshold is generally described as 500 or more individuals.

The media requirement is described in terms of more than 500 residents of a state or jurisdiction.

Those are related rules, but they are not worded identically.

This is also a situation where a practice may want legal or privacy counsel involved, especially if the breach crosses state lines or additional state breach-notification laws may apply.

HIPAA is not necessarily the only law in play.

What if a business associate caused the breach?

Suppose your billing company, EHR vendor, cloud provider, transcription service, or another business associate tells you it experienced a breach involving your patients' PHI.

It can be tempting to think:

The vendor caused it, so the vendor handles everything.

That is not necessarily true.

Under HIPAA, a business associate that discovers a breach of unsecured PHI must notify the covered entity.

That notification must generally be made without unreasonable delay and no later than 60 calendar days after the business associate discovers the breach.

The business associate should also provide, to the extent possible, information about the affected individuals and other information the covered entity needs for notification.

Your business associate agreement may require the vendor to notify you much sooner than the federal outside limit.

And it often should.

If a vendor waits close to 60 days before telling the practice, the covered entity can be left trying to understand the incident, identify patients, prepare notices, and satisfy its own obligations under severe time pressure.

HHS has also made clear that even when a business associate handles some notification tasks on behalf of the covered entity, the covered entity ultimately retains responsibility for the required notices.

So when a vendor reports a breach, ask practical questions immediately:

• When did you first discover it?
• When did the unauthorized activity actually occur?
• Which of our patients were affected?
• What PHI was involved?
• Was the information actually viewed, downloaded, altered, or exfiltrated?
• What has been done to contain the incident?
• Are you preparing notifications?
• Who will submit the HHS report?
• What documentation will you provide to us?
• When will we receive the final affected-individual list?

“The vendor is handling it” is not a sufficient incident file.

What if the number of affected people changes?

This happens.

You may initially believe that 120 people were affected and later discover that the real number is 640.

Or the vendor may identify an additional database after the initial report.

That can change which notification rules apply.

HHS allows organizations to submit supplemental information when new facts modify or clarify an earlier breach report.

The practical lesson is simple:

Do not treat the first affected-individual count as permanently fixed if the investigation is still developing.

Document estimates as estimates.

Update the incident record as the facts become clearer.

And if the number crosses a regulatory threshold, reassess the notification obligations promptly.

What the 60-day rule does not mean

The 60-day rule is easy to oversimplify.

Here is what it does not mean.

What should the practice document while the clock is running?

Do not let all the attention on notifications cause the underlying incident record to fall apart.

Continue documenting:

• discovery date;
• breach determination;
• affected systems;
• affected individuals;
• categories of PHI involved;
• investigation findings;
• vendor communications;
• mitigation;
• corrective actions;
• notice drafts;
• dates notices were mailed or otherwise provided;
• HHS submission records;
• media notification, if applicable;
• supplemental reports;
• decisions about notification scope;
• legal or insurance communications where appropriate; and
• final closure.

If someone reviews the incident later, they should not have to reconstruct the response from scattered email messages and someone's memory.

The record should show the sequence clearly.

A practical small-practice breach timeline

Imagine a practice discovers on September 3 that an employee mailbox was compromised and later determines that unsecured PHI was accessed.

A practical response might look like this:

The exact dates will vary from incident to incident.

The point is not that every breach should follow a two-week schedule.

The point is that the practice should be moving forward continuously.

The clock is a deadline.

It is not the project plan.

Frequently asked questions

The 60-day deadline is not the response plan

When a breach occurs, the number “60” tends to become the center of attention.

But a good breach response is not:

We have 60 days. Put it on the calendar.

It is:

Document the discovery. Keep investigating. Identify the affected people. Understand what information was involved. Mitigate the problem. Prepare accurate notices. Notify without unreasonable delay. Complete required HHS and media reporting. Keep the evidence.

The 60-day limit matters.

But it is the outside boundary of the notification process—not permission to stop moving.

If you are still deciding whether an incident is actually a breach, read HIPAA Incident vs. Breach: What's the Difference?

If you just discovered a cybersecurity incident and need to know what to do in the first minutes and hours, read What Should a Small Medical Practice Do Immediately After Discovering a Cybersecurity Incident?

For the entire process—from discovery and containment through investigation, breach assessment, notification, corrective action, and closure—see HIPAA Incident and Breach Response for Small Practices: A Step-by-Step Guide.

HIPAA Assistant can help small practices organize incident records, investigation details, breach-assessment documentation, corrective actions, and response history. The organization remains responsible for its own breach determination and any required notifications.

This article provides general educational information and is not legal advice. Additional federal, state, contractual, insurance, or other requirements may apply depending on the circumstances of a particular breach.