45 CFR 164.408 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information
45 CFR 164.408 HIPAA: Notification to the Secretary
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
Official text
Standard. A covered entity shall, following the discovery of a breach of unsecured protected health information as provided in § 164.404(a)(2), notify the Secretary.
Implementation specifications: Breaches involving 500 or more individuals. For breaches of unsecured protected health information involving 500 or more individuals, a covered entity shall, except as provided in § 164.412, provide the notification required by paragraph (a) of this section contemporaneously with the notice required by § 164.404(a) and in the manner specified on the HHS Web site.
Implementation specifications: Breaches involving less than 500 individuals. For breaches of unsecured protected health information involving less than 500 individuals, a covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provide the notification required by paragraph (a) of this section for breaches discovered during the preceding calendar year, in the manner specified on the HHS web site.
Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.
Source credit: [74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
This is reference material, not legal advice.