Section § 164.404Notification to individuals

What it says

(a) Standard—(1) General rule. A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.

(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, §§ 164.406(a), and 164.408(a), a breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity. A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity (determined in accordance with the federal common law of agency).

(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification—(1) Elements. The notification required by paragraph (a) of this section shall include, to the extent possible:

(A) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;

(B) A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);

(C) Any steps individuals should take to protect themselves from potential harm resulting from the breach;

(D) A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and

(E) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.

(2) Plain language requirement. The notification required by paragraph (a) of this section shall be written in plain language.

(d) Implementation specifications: Methods of individual notification. The notification required by paragraph (a) of this section shall be provided in the following form:

(1) Written notice. (i) Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail. The notification may be provided in one or more mailings as information is available.

(ii) If the covered entity knows the individual is deceased and has the address of the next of kin or personal representative of the individual (as specified under § 164.502(g)(4) of subpart E), written notification by first-class mail to either the next of kin or personal representative of the individual. The notification may be provided in one or more mailings as information is available.

(2) Substitute notice. In the case in which there is insufficient or out-of-date contact information that precludes written notification to the individual under paragraph (d)(1)(i) of this section, a substitute form of notice reasonably calculated to reach the individual shall be provided. Substitute notice need not be provided in the case in which there is insufficient or out-of-date contact information that precludes written notification to the next of kin or personal representative of the individual under paragraph (d)(1)(ii).

(i) In the case in which there is insufficient or out-of-date contact information for fewer than 10 individuals, then such substitute notice may be provided by an alternative form of written notice, telephone, or other means.

(ii) In the case in which there is insufficient or out-of-date contact information for 10 or more individuals, then such substitute notice shall:

(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and

(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.

(3) Additional notice in urgent situations. In any case deemed by the covered entity to require urgency because of possible imminent misuse of unsecured protected health information, the covered entity may provide information to individuals by telephone or other means, as appropriate, in addition to notice provided under paragraph (d)(1) of this section.

HIPAA, the United States rules protecting health information, § 164.404

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Business Associate Agreement Security Terms

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Gives the security team the terms to check in a business associate agreement, each with its source and a pointer to the supplier clause library. It is not a legal template.
• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• DOCWord

  Security Incident Management Policy

  in Security Incident ManagementIts Framework References cite this section. Commits the organisation to detecting, reporting, responding to and learning from incidents, and assigns authority to declare and escalate.
• DOCWord

  Incident Response Plan

  in Security Incident ManagementIts Framework References cite this section. Defines the response organisation, phases, decision authorities and hand-offs used for every incident regardless of type.
• XLSExcel

  Incident Classification, Severity & Escalation Matrix

  in Security Incident ManagementIts Framework References cite this section. Classifies events by impact criteria and maps each severity to escalation paths, notification triggers and response-time targets.
• DOCWord

  Incident Triage & First-Hour Assessment Procedure

  in Security Incident ManagementIts Framework References cite this section. Guides the first responder from initial report to a classification decision within the first hour, including evidence preservation.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• DOCWord

  Incident Communications Template Set

  in Security Incident ManagementIts Framework References cite this section. Pre-drafted internal, executive, customer and supplier messages for each severity level with approval routing.
• PPTPowerPoint

  Tabletop Scenario — Health Data Breach and the 60-Day Clock

  in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References cite this section. Inject deck and facilitator notes testing the HIPAA breach assessment, discovery against declaration, the business associate chain and State-law notices on a 60-day clock.
• DOCWord

  Reportability Decision Model

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Structured decision tree for whether an incident is significant, major or notifiable, with the reasoning recorded.
• DOCWord

  Regulatory Notification Operating Procedure

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Assigns decision authority, drafting, legal review, submission and follow-up reporting for each regime.
• XLSExcel

  Regulatory Notification Log

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Records each notification decision, submission time, reference number and follow-up obligation.
• XLSExcel

  Notification Readiness Checklist

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Confirms portal access, authority contacts, delegated signatories and templates are ready before an incident.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.
• DOCWord

  US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Drafting templates for the US notices: to individuals, to the media and the Secretary of Health and Human Services, on Form 8-K, to the New York Superintendent and to a State attorney general.