--- title: "16 CFR 318.6 Health Breach Notification Rule: Content of notice" canonical: "https://dposchool.com/health-breach-notification-rule/section/318.6" source: "https://www.ecfr.gov/current/title-16/section-318.6" source_note: "Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 16 CFR 318.6 Health Breach Notification Rule · Part 318: HEALTH BREACH NOTIFICATION RULE # 16 CFR 318.6 Health Breach Notification Rule: Content of notice eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text Regardless of the method by which notice is provided to individuals under § 318.5 (regarding methods of notice), notice of a breach of security shall be in plain language and include, to the extent possible, the following: ### 16 CFR 318.6(a) **(a)** A brief description of what happened, including: the date of the breach and the date of the discovery of the breach, if known; and the full name or identity (or, where providing the full name or identity would pose a risk to individuals or the entity providing notice, a description) of any third parties that acquired unsecured PHR identifiable health information as a result of a breach of security, if this information is known to the vendor of personal health records or PHR related entity; ### 16 CFR 318.6(b) **(b)** A description of the types of unsecured PHR identifiable health information that were involved in the breach (such as but not limited to full name, Social Security number, date of birth, home address, account number, health diagnosis or condition, lab results, medications, other treatment information, the individual's use of a health-related mobile application, or device identifier (in combination with another data element)); ### 16 CFR 318.6(c) **(c)** Steps individuals should take to protect themselves from potential harm resulting from the breach; ### 16 CFR 318.6(d) **(d)** A brief description of what the entity that experienced the breach is doing to investigate the breach, to mitigate harm, to protect against any further breaches, and to protect affected individuals, such as offering credit monitoring or other services; and ### 16 CFR 318.6(e) **(e)** Contact procedures for individuals to ask questions or learn additional information, which must include two or more of the following: toll-free telephone number; email address; website; within-application; or postal address. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [16 CFR 318.6 on eCFR](https://www.ecfr.gov/current/title-16/section-318.6) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [Health Breach Notification Rule Navigator](https://dposchool.com/health-breach-notification-rule) / 16 CFR 318.6 Previous: [16 CFR 318.5 Health Breach Notification Rule: Methods of notice](https://dposchool.com/health-breach-notification-rule/section/318.5) Next: [16 CFR 318.7 Health Breach Notification Rule: Enforcement](https://dposchool.com/health-breach-notification-rule/section/318.7) ## For AI agents - Machine-readable index: https://dposchool.com/health-breach-notification-rule/llms.txt - JSON API: https://dposchool.com/health-breach-notification-rule/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents