Section § 164.406Notification to the media

What it says

(a) Standard. For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in § 164.404(a)(2), notify prominent media outlets serving the State or jurisdiction.

(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification. The notification required by paragraph (a) of this section shall meet the requirements of § 164.404(c).

HIPAA, the United States rules protecting health information, § 164.406

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Business Associate Agreement Security Terms

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Gives the security team the terms to check in a business associate agreement, each with its source and a pointer to the supplier clause library. It is not a legal template.
• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• XLSExcel

  Incident Classification, Severity & Escalation Matrix

  in Security Incident ManagementIts Framework References cite this section. Classifies events by impact criteria and maps each severity to escalation paths, notification triggers and response-time targets.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• DOCWord

  Incident Communications Template Set

  in Security Incident ManagementIts Framework References cite this section. Pre-drafted internal, executive, customer and supplier messages for each severity level with approval routing.
• PPTPowerPoint

  Tabletop Scenario — Health Data Breach and the 60-Day Clock

  in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References cite this section. Inject deck and facilitator notes testing the HIPAA breach assessment, discovery against declaration, the business associate chain and State-law notices on a 60-day clock.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.
• DOCWord

  US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Drafting templates for the US notices: to individuals, to the media and the Secretary of Health and Human Services, on Form 8-K, to the New York Superintendent and to a State attorney general.