--- title: "16 CFR 318.4 Health Breach Notification Rule: Timeliness of notification" canonical: "https://dposchool.com/health-breach-notification-rule/section/318.4" source: "https://www.ecfr.gov/current/title-16/section-318.4" source_note: "Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 318.4 Health Breach Notification Rule · Part 318: HEALTH BREACH NOTIFICATION RULE # 16 CFR 318.4 Health Breach Notification Rule: Timeliness of notification eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 16 CFR 318.4(a) **(a)** In general. Except as provided in paragraph (d) of this section (exception for law enforcement), all notifications required under § 318.3(a)(1) (required notice to individuals), (a)(3) (required notice to media), and (b) (required notice by third party service providers), shall be sent without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security. ### 16 CFR 318.4(b) **(b)** Timing of notice to FTC. All notifications required under § 318.5(c) (regarding notice to FTC) involving the unsecured PHR identifiable health information of 500 or more individuals shall be provided contemporaneously with the notice required by paragraph (a) of this section. All logged notifications required under § 318.5(c) (regarding notice to FTC) involving the unsecured PHR identifiable health information of fewer than 500 individuals may be sent annually to the Federal Trade Commission no later than 60 calendar days following the end of the calendar year. ### 16 CFR 318.4(c) **(c)** Burden of proof. The vendor of personal health records, PHR related entity, and third party service provider involved shall have the burden of demonstrating that all notifications were made as required under this part, including evidence demonstrating the necessity of any delay. ### 16 CFR 318.4(d) **(d)** Law enforcement exception. If a law enforcement official determines that a notification, notice, or posting required under this part would impede a criminal investigation or cause damage to national security, such notification, notice, or posting shall be delayed. This paragraph (d) shall be implemented in the same manner as provided under 45 CFR 164.528(a)(2), in the case of a disclosure covered under § 164.528(a)(2). ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 318.4 on eCFR](https://www.ecfr.gov/current/title-16/section-318.4) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [Health Breach Notification Rule Navigator](https://dposchool.com/health-breach-notification-rule) / 16 CFR 318.4 Previous: [16 CFR 318.3 Health Breach Notification Rule: Breach notification requirement](https://dposchool.com/health-breach-notification-rule/section/318.3) Next: [16 CFR 318.5 Health Breach Notification Rule: Methods of notice](https://dposchool.com/health-breach-notification-rule/section/318.5) ## For AI agents - Machine-readable index: https://dposchool.com/health-breach-notification-rule/llms.txt - JSON API: https://dposchool.com/health-breach-notification-rule/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents