--- title: "16 CFR 318.3 Health Breach Notification Rule: Breach notification requirement" canonical: "https://dposchool.com/health-breach-notification-rule/section/318.3" source: "https://www.ecfr.gov/current/title-16/section-318.3" source_note: "Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 318.3 Health Breach Notification Rule · Part 318: HEALTH BREACH NOTIFICATION RULE # 16 CFR 318.3 Health Breach Notification Rule: Breach notification requirement eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 16 CFR 318.3(a) **(a)** In general. In accordance with §§ 318.4 (regarding timeliness of notification), 318.5 (regarding methods of notice), and 318.6 (regarding content of notice), each vendor of personal health records, following the discovery of a breach of security of unsecured PHR identifiable health information that is in a personal health record maintained or offered by such vendor, and each PHR related entity, following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall: #### 16 CFR 318.3(a)(1) **(1)** Notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such breach of security; #### 16 CFR 318.3(a)(2) **(2)** Notify the Federal Trade Commission; and #### 16 CFR 318.3(a)(3) **(3)** Notify prominent media outlets serving a State or jurisdiction, following the discovery of a breach of security, if the unsecured PHR identifiable health information of 500 or more residents of such State or jurisdiction is, or is reasonably believed to have been, acquired during such breach. ### 16 CFR 318.3(b) **(b)** Third party service providers. A third party service provider shall, following the discovery of a breach of security, provide notice of the breach to an official designated in a written contract by the vendor of personal health records or the PHR related entity to receive such notices or, if such a designation is not made, to a senior official at the vendor of personal health records or PHR related entity to which it provides services, and obtain acknowledgment from such official that such notice was received. Such notification shall include the identification of each customer of the vendor of personal health records or PHR related entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during such breach. For purposes of ensuring implementation of this paragraph (b), vendors of personal health records and PHR related entities shall notify third party service providers of their status as vendors of personal health records or PHR related entities subject to this part. While some third party service providers may access unsecured PHR identifiable health information in the course of providing services, this does not render the third party service provider a PHR related entity. ### 16 CFR 318.3(c) **(c)** Breaches treated as discovered. A breach of security shall be treated as discovered as of the first day on which such breach is known or reasonably should have been known to the vendor of personal health records, PHR related entity, or third party service provider, respectively. Such vendor, entity, or third party service provider shall be deemed to have knowledge of a breach if such breach is known, or reasonably should have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of such vendor of personal health records, PHR related entity, or third party service provider. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 318.3 on eCFR](https://www.ecfr.gov/current/title-16/section-318.3) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [Health Breach Notification Rule Navigator](https://dposchool.com/health-breach-notification-rule) / 16 CFR 318.3 Previous: [16 CFR 318.2 Health Breach Notification Rule: Definitions](https://dposchool.com/health-breach-notification-rule/section/318.2) Next: [16 CFR 318.4 Health Breach Notification Rule: Timeliness of notification](https://dposchool.com/health-breach-notification-rule/section/318.4) ## For AI agents - Machine-readable index: https://dposchool.com/health-breach-notification-rule/llms.txt - JSON API: https://dposchool.com/health-breach-notification-rule/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents