Section § 164.410Notification by a business associate

What it says

(a) Standard—(1) General rule. A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach.

(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, a breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate (determined in accordance with the Federal common law of agency).

(b) Implementation specifications: Timeliness of notification. Except as provided in § 164.412, a business associate shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification. (1) The notification required by paragraph (a) of this section shall include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, used, or disclosed during the breach.

(2) A business associate shall provide the covered entity with any other available information that the covered entity is required to include in notification to the individual under § 164.404(c) at the time of the notification required by paragraph (a) of this section or promptly thereafter as information becomes available.

HIPAA, the United States rules protecting health information, § 164.410

What is in the packs for this

Each one helps with this requirement.

• DOCWord

  Business Associate Agreement Security Terms

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Gives the security team the terms to check in a business associate agreement, each with its source and a pointer to the supplier clause library. It is not a legal template.
• DOCWord

  Breach Assessment & Notification Decision Procedure

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Walks an incident through the breach presumption, the exclusions, secured information and the four-factor assessment, to a signed decision.
• XLSExcel

  Incident Classification, Severity & Escalation Matrix

  in Security Incident ManagementIts Framework References cite this section. Classifies events by impact criteria and maps each severity to escalation paths, notification triggers and response-time targets.
• DOCWord

  Personal Data Breach Response Playbook

  in Security Incident ManagementIts Framework References cite this section. Runs the security and privacy tracks of a personal data breach in parallel so the notification decision is made on facts.
• PPTPowerPoint

  Tabletop Scenario — Health Data Breach and the 60-Day Clock

  in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References cite this section. Inject deck and facilitator notes testing the HIPAA breach assessment, discovery against declaration, the business associate chain and State-law notices on a 60-day clock.
• DOCWord

  Regulatory Notification Operating Procedure

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Assigns decision authority, drafting, legal review, submission and follow-up reporting for each regime.
• XLSExcel

  Notification Readiness Checklist

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Confirms portal access, authority contacts, delegated signatories and templates are ready before an incident.
• XLSExcel

  US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.
• DOCWord

  US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

  in Regulatory Incident Notification & ReportingIts Framework References cite this section. Drafting templates for the US notices: to individuals, to the media and the Secretary of Health and Human Services, on Form 8-K, to the New York Superintendent and to a State attorney general.