45 CFR 164.414 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information
45 CFR 164.414 HIPAA: Administrative requirements and burden of proof
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
Official text
Administrative requirements. A covered entity is required to comply with the administrative requirements of § 164.530(b), (d), (e), (g), (h), (i), and (j) with respect to the requirements of this subpart.
Burden of proof. In the event of a use or disclosure in violation of subpart E, the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach, as defined at § 164.402.
Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
This is reference material, not legal advice.