Section § 164.408Notification to the Secretary

What it says

(a) Standard. A covered entity shall, following the discovery of a breach of unsecured protected health information as provided in § 164.404(a)(2), notify the Secretary.

(b) Implementation specifications: Breaches involving 500 or more individuals. For breaches of unsecured protected health information involving 500 or more individuals, a covered entity shall, except as provided in § 164.412, provide the notification required by paragraph (a) of this section contemporaneously with the notice required by § 164.404(a) and in the manner specified on the HHS Web site.

(c) Implementation specifications: Breaches involving less than 500 individuals. For breaches of unsecured protected health information involving less than 500 individuals, a covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provide the notification required by paragraph (a) of this section for breaches discovered during the preceding calendar year, in the manner specified on the HHS web site.

HIPAA, the United States rules protecting health information, § 164.408

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Business Associate Agreement Security Terms

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Gives the security team the terms to check in a business associate agreement, each with its source and a pointer to the supplier clause library. It is not a legal template.
• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• DOCWord

  Incident Response Plan

  in Security Incident ManagementIts Framework References cite this section. Defines the response organisation, phases, decision authorities and hand-offs used for every incident regardless of type.
• XLSExcel

  Incident Classification, Severity & Escalation Matrix

  in Security Incident ManagementIts Framework References cite this section. Classifies events by impact criteria and maps each severity to escalation paths, notification triggers and response-time targets.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• PPTPowerPoint

  Tabletop Scenario — Health Data Breach and the 60-Day Clock

  in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References cite this section. Inject deck and facilitator notes testing the HIPAA breach assessment, discovery against declaration, the business associate chain and State-law notices on a 60-day clock.
• DOCWord

  Regulatory Notification Operating Procedure

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Assigns decision authority, drafting, legal review, submission and follow-up reporting for each regime.
• XLSExcel

  Regulatory Notification Log

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Records each notification decision, submission time, reference number and follow-up obligation.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.
• DOCWord

  US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Drafting templates for the US notices: to individuals, to the media and the Secretary of Health and Human Services, on Form 8-K, to the New York Superintendent and to a State attorney general.