45 CFR 164.412 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information
45 CFR 164.412 HIPAA: Law enforcement delay
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
Official text
If a law enforcement official states to a covered entity or business associate that a notification, notice, or posting required under this subpart would impede a criminal investigation or cause damage to national security, a covered entity or business associate shall:
If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the time period specified by the official; or
If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in paragraph (a) of this section is submitted during that time.
Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
This is reference material, not legal advice.