US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

UT-01 Notice to individuals (HIPAA and State law)

RD-17, RD-25

Each individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used or disclosed

Executive incident lead, with the privacy lead and Legal (CT-11)

RD-17: Without unreasonable delay and in no case later than 60 calendar days after discovery

RD-25: [[the deadline of each State where affected residents live, for example 30 days]]

UT-02 Notice to prominent media outlets (HIPAA)

RD-18

Prominent media outlets serving the State or jurisdiction

Executive incident lead, with Legal (CT-12)

Without unreasonable delay and in no case later than 60 calendar days after discovery, where more than 500 residents of one State or jurisdiction are involved

UT-03 Notice to the Secretary of Health and Human Services (content for the portal)

RD-19

Secretary of Health and Human Services (Office for Civil Rights)

Executive incident lead, with Legal (CT-12)

500 or more individuals: contemporaneously with the notice to individuals (no later than 60 calendar days after discovery); fewer than 500: log the breach and report it within 60 days after the end of the calendar year of discovery

UT-04 Business associate's notice to the covered entity

RD-20

[[the covered entity we serve]]

Executive incident lead, with Legal (CT-12)

Without unreasonable delay and in no case later than 60 calendar days after discovery (the contract usually sets a shorter time)

UT-05 Form 8-K Item 1.05: material cybersecurity incident

RD-21

Securities and Exchange Commission

Executive incident lead, with Legal; for a Form 8-K, the person or committee that determines materiality (CT-12)

Within four business days after the company determines the incident is material; missing information is filed by amendment within four business days after it is determined or becomes available; a filing whose transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day, so the last safe time is 5:30 p.m. Eastern on the fourth business day

UT-06 Form 8-K/A: information not available at the first filing

RD-21

Securities and Exchange Commission

Executive incident lead, with Legal; for a Form 8-K, the person or committee that determines materiality (CT-12)

Within four business days after the company determines the incident is material; missing information is filed by amendment within four business days after it is determined or becomes available; a filing whose transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day, so the last safe time is 5:30 p.m. Eastern on the fourth business day

UT-07 New York: notice of a cybersecurity incident

RD-22

New York Department of Financial Services

Executive incident lead, with Legal (CT-12)

As promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred

UT-08 New York: notice of an extortion payment and the written description

RD-23, RD-24

New York Department of Financial Services

Executive incident lead, with Legal (CT-12)

RD-23: Within 24 hours of the extortion payment

RD-24: Within 30 days of the extortion payment

UT-09 Notice to a State attorney general or regulator

RD-26, RD-27

A State attorney general or regulator (RD-26); the consumer reporting agencies (RD-27)

Executive incident lead, with Legal (CT-12)

RD-26: [[whether, when and above what number of residents each State requires it]]

RD-27: [[where a State requires it, with its threshold]]

UT-10 FTC Safeguards Rule: notice to the Commission

RD-28

Federal Trade Commission

Executive incident lead, with Legal (CT-12)

As soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers

UT-11 FTC Health Breach Notification Rule: notices

RD-29

Individuals; prominent media outlets; the Federal Trade Commission

Executive incident lead, with the privacy lead and Legal (CT-11 and CT-12)

Without unreasonable delay and in no case later than 60 calendar days after discovery: individuals, and for 500 or more residents of a State the media; the FTC at the same time for 500 or more individuals, or in an annual log for fewer

Screen and decide

The privacy officer assesses; executive incident lead decides

The person or committee that determines materiality (RN-19); the executive incident lead decides to file

Incident manager determines the incident; the executive incident lead decides

The privacy officer reads each State; the executive incident lead decides

Legal advises; the executive incident lead decides

Draft

Privacy officer

Legal, with Finance

Incident manager

Privacy officer

Legal

Review

Legal

Legal

Legal

Legal

Legal

Approve

Executive incident lead, with the privacy lead and Legal

Executive incident lead, with Legal; for a Form 8-K, the person or committee that determines materiality

Executive incident lead, with Legal

Executive incident lead, with the privacy lead and Legal

Executive incident lead, with Legal

Submit and log

Notification signatory

Notification signatory with EDGAR access

Notification signatory

Notification signatory

Notification signatory

Notice to people

Communications lead; approved as P09 CT-11 (media notice as CT-12)

—

—

Communications lead; approved as P09 CT-11

Communications lead; approved as P09 CT-11

What happened

A plain account in a few sentences: what happened, on what date, when and how we discovered it, and whether it is still going on. Give the date of the breach and the date of discovery, if known.

What information was involved

The kinds of information about this person: for example name, date of birth, address, member or account number, diagnosis or treatment details, claims information. Say whether a Social Security number or a financial account number was involved.

What we are doing

What we have done to investigate, to limit the harm and to prevent it happening again; who is helping; whether law enforcement has been told.

What you can do

Steps this person can take: review statements and explanation-of-benefits forms for services they did not receive; report anything unfamiliar; where Social Security or financial account numbers were involved, how to place a fraud alert or a security freeze, and any credit monitoring we are offering, with the enrolment code and the date it ends.

For more information

A toll-free telephone number with its hours, an email address, a website or a postal address. HIPAA asks for one of these; a State may ask for more.

Incident

case number and title

[[INC-YYYY-NNN: title]]

Duty

P09, and the template's own number

RD-17, RD-25 · UT-01

Goes to

Each individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used or disclosed

By which channel

[[first-class mail, or email where the individual agreed]]

Discovered

first known by anyone (P09 IM-13)

[[YYYY-MM-DD HH:MM]]

Due

from P18-A09, the clock this duty runs

[[YYYY-MM-DD HH:MM, or end of YYYY-MM-DD]]

Decided by

RN-06, RN-19

[[Name, role; decision ID]]

Approved by

CT-11 or CT-12

[[Name]], Executive incident lead, with the privacy lead and Legal (CT-11)

Who we are

covered entity or business associate

[[Legal name, address, type, and whether a business associate was involved]]

Contact

at any hour during the incident

[[Name, role, email, telephone]]

Date of the breach

or the period

[[YYYY-MM-DD, or from YYYY-MM-DD to YYYY-MM-DD]]

Date of discovery

IM-13

[[YYYY-MM-DD]]

Individuals affected

all, and by State

[[Total; by State]]

Type of breach

and where the information was

[[e.g. unauthorised access to a database; portal, server, email, paper]]

Types of information

FB-22

[[Identifiers, clinical, financial; secured or unsecured]]

Safeguards in place before

and what we have done since

[[Controls that were in place; steps taken to respond and prevent a repeat]]

Notice to individuals

UT-01, with the date sent and how

[[Date; first-class mail / email; substitute notice if used]]

Notice to the media

UT-02, where more than 500 residents of one State

[[Date; outlets; or not required]]

Law-enforcement delay

DL-01

[[None / who asked, when, in what form, for how long]]

Contemporaneous with UT-01?

500 or more individuals

[[Yes / no, and if fewer than 500: logged for the annual report]]

From and to

business associate, covered entity

[[Our name]] (business associate) to [[Covered entity]]

Agreement

and the notice period in it

[[Agreement reference; notice within n days / hours]]

We discovered

the first day anyone, or any agent, knew

[[YYYY-MM-DD HH:MM]]

Notice due by

the agreement's period, or 60 calendar days

[[YYYY-MM-DD HH:MM]]

What happened

the breach, as far as known

[[Facts in a few sentences]]

Individuals

identification of each (164.410(c)(1))

[[The list, with identifiers, attached or sent by secure means]]

People and records

categories and approximate number

[[Categories; about n]]

Types of information

FB-22

[[Identifiers, clinical, financial; secured or unsecured]]

Measures

taken and proposed

[[What we have done and will do]]

Other information you will need

for your own notice, to follow as it becomes available (164.410(c)(2))

[[What is not yet known, who is finding it out, next update YYYY-MM-DD HH:MM]]

Our contact

[[Name, role, email, telephone]]

Covered entity

and the licence or authorisation that makes it one

[[Legal name; licence under the Banking Law, Insurance Law or Financial Services Law]]

Contact

at any hour

[[Name, role, email, telephone]]

Determined that a cybersecurity incident occurred

the time the 72 hours run from

[[YYYY-MM-DD HH:MM]]

Which limb of the definition

500.1: notice to a government body, self-regulatory agency or other supervisory body; material harm to operations; ransomware

[[Limb and why]]

Where it happened

the entity, an affiliate or a third-party service provider

[[Entity / affiliate / provider name]]

Systems and data affected

FB-08, FB-22

[[Systems; data; encryption]]

What happened

as far as known

[[Facts in a few sentences]]

Extortion

demand or payment, and the clocks it opens (UT-08)

[[None / demand received / payment made on YYYY-MM-DD HH:MM]]

Other notices

HHS, SEC, State, law enforcement

[[Each notice and its time]]

Updates

the Superintendent's requests and material changes

[[What was requested; next update YYYY-MM-DD HH:MM]]

Submitted by, and the reference

[[Name; reference the portal returned]]

Covered entity

and the case reference from UT-07

[[Legal name; UT-07 reference]]

Payment made

date and time

[[YYYY-MM-DD HH:MM]]

The payment

amount, form and to whom, as far as known

[[Amount; cryptocurrency or other; recipient]]

Decided by

the board or its equivalent (IM-08)

[[Names; date and time]]

The reasons the payment was necessary

[[Why payment was necessary: what was lost or at risk, and why it could not be recovered another way]]

The alternatives considered

[[Each alternative: restore from backup, rebuild, negotiate, do not pay; why each was not enough]]

The diligence performed to find alternatives

[[Who was consulted, what was tried, how long it took]]

The diligence performed to ensure compliance with applicable rules and regulations

including the Office of Foreign Assets Control

[[Sanctions screening of the recipient and the wallet or account, legal advice taken, law-enforcement contact, results]]

Signed

the person responsible, and the date

[[Name, role; YYYY-MM-DD]]

Submitted by, and the reference

[[Name; reference]]

State

and the statute

[[State; statute, e.g. California Civil Code 1798.82, New York General Business Law 899-aa]]

Required here because

residents above the State's number, or always

[[Number of residents; the State's threshold]]

Residents notified

the number, and the date and method of notice to them

[[n; YYYY-MM-DD; mail / email / substitute]]

Copy of the notice

the State often asks for a sample, without personal information

[[Attached UT-01 with personal information removed]]

Our contact

for the attorney general's office

[[Name, role, email, telephone]]

What happened

in brief, as in UT-01

[[Two or three sentences]]

Other content the State asks for

read the statute and the office's current form

[[e.g. the types of information, credit monitoring offered, steps taken, dates of breach and discovery]]

Delay

for law enforcement or to determine scope, as this State allows (DL-04)

[[None / who, when, for how long]]

Submitted by, and when

[[Name; YYYY-MM-DD HH:MM]]

State

and the threshold

[[State; statute; the number of residents above which the agencies are told]]

Agencies notified

each, and how

[[Names; contact points; YYYY-MM-DD HH:MM]]

Timing, distribution and approximate number of the notices to residents

[[Date sent; method; about n residents]]

Copy of the notice

if the State asks for one

[[Attached, without personal information / not required]]

Reporting financial institution

name and contact

[[Legal name; contact name, role, email, telephone]]

Consumers

affected or potentially affected, at least 500

[[n]]

Types of information

involved in the notification event

[[Identifiers, account information, other; whether unencrypted, and whether an encryption key was accessed]]

Date or date range

if possible to determine

[[YYYY-MM-DD, or from YYYY-MM-DD to YYYY-MM-DD]]

General description

of the notification event

[[Facts in a few sentences]]

Law enforcement

has an official determined in writing that public notice would impede a criminal investigation or harm national security?

[[No / yes: the official, the date, and a way for the Commission to contact them]]

Submitted by, on the Commission's form

[[Name; YYYY-MM-DD HH:MM; reference]]

Individuals

content, in plain language (318.6)

[[What happened, with the dates of the breach and of discovery and any third parties that acquired the information; the types of information; the steps they should take; what we are doing; contact procedures with at least two of: toll-free number, email, website, an option within the application, postal address]]

How sent

318.5

[[Written notice by first-class mail, or email if the individual chose it; substitute notice if contact details for ten or more are out of date; telephone in urgent cases]]

Media

500 or more residents of a State

[[Date; outlets]]

The Commission

contemporaneously for 500 or more individuals, or in the annual log for fewer

[[Date; the Commission's online form; reference / logged for YYYY]]

Law-enforcement exception

DL-03

[[None / who, when, for how long]]

Incident

INC-2026-021: Patient portal database read through a stolen administrator credential

Duty

RD-17 · UT-01

Goes to

Each of the 3,200 affected members

By which channel

First-class mail; substitute notice for the 14 whose addresses were out of date

Discovered

14 Sep 2026, 16:40

Due

end of 13 Nov 2026

Decided by

Executive incident lead; USD-2026-001

Approved by

Executive incident lead, with the privacy lead and Legal (CT-11)

From and to

Example Health Group, Inc. (business associate) to [[Covered Entity Customer A]]

Agreement

[[Agreement reference]]; notice within 3 days

We discovered

22 Sep 2026, 10:15

Notice due by

end of 25 Sep 2026 (the agreement's 3 days); the outer limit is end of 21 Nov 2026

What happened

For its analytics service, the organisation is a business associate of other covered entities. A data export for one covered-entity customer was delivered to another customer's folder; the second customer, itself a HIPAA covered entity, opened it and later confirmed in writing that it had deleted its copy. 480 individuals' records were involved. Whether that supports a finding of low probability of compromise is the first customer's decision, as the covered entity; the organisation gives it the facts.

Individuals

The list of the 480 individuals, with identifiers, sent by secure transfer.

People and records

480 individuals; about 480 records

Types of information

Names, dates of birth, member numbers and claims details; unsecured

Measures

The file was removed from the second customer's folder; the second customer confirmed in writing that it deleted its copy; the export now needs a second check of the destination.

Still to follow

Nothing outstanding; we will tell you if the second customer reports any use.

Our contact

Privacy Officer, [[email and telephone]]

P09 Personal Data Breach Response Playbook

The response and the HIPAA assessment these templates put into words

P09 Incident Communications Template Set

CT-11 and CT-12, their approvers and the approval log

US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

The clock, the recipient and the content of each duty; the Clock Calculator

Reportability Decision Model

The US tests (DS-11 to DS-16) and the outcomes these templates follow

Regulatory Notification Operating Procedure

Who drafts, reviews, approves and submits (RN-07 to RN-10, RN-19 to RN-22)

Regulatory Notification Log

Where each decision and submission is logged

Notification Readiness Checklist

The checks that the templates, signatories, channels and accounts are ready (RC-19 to RC-26)

ISO/IEC 27001:2022

Annex A 5.34 — Privacy and protection of PII

UT-01, UT-04 and UT-11: notices that protect the people whose information was involved

ISO/IEC 27001:2022

Annex A 5.5 — Contact with authorities

UT-03 to UT-10: notifying each authority through its own channel

NIST CSF 2.0

RS.CO-02 — “Internal and external stakeholders are notified of incidents”

The whole set: individuals, authorities and the market notified of incidents

HIPAA — 45 CFR Part 164, Subpart D (breach notification)

§ 164.404 — a covered entity notifies each affected individual without unreasonable delay and no later than 60 calendar days after discovery; a breach is treated as discovered on the first day it is known, or by reasonable diligence would have been known, to any workforce member or agent other than the person who committed it; the notice says what happened, what information was involved, what individuals should do, what the entity is doing, and how to ask questions, in plain language

UT-01: the five elements of the notice, the methods of notice and substitute notice

HIPAA — 45 CFR Part 164, Subpart D (breach notification)

§ 164.406 — for a breach involving more than 500 residents of a State or jurisdiction, a covered entity notifies prominent media outlets serving that State or jurisdiction, within the same 60 calendar days and with the content of § 164.404(c)

UT-02: the media notice and its content

HIPAA — 45 CFR Part 164, Subpart D (breach notification)

§ 164.408 — a covered entity notifies the Secretary of Health and Human Services: for 500 or more individuals contemporaneously with the notice to individuals; for fewer than 500, it keeps a log and notifies not later than 60 days after the end of each calendar year, for breaches discovered in the year before

UT-03: the notice to the Secretary

HIPAA — 45 CFR Part 164, Subpart D (breach notification)

§ 164.410 — a business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovery (a breach is treated as discovered when known to the business associate or to any employee, officer or other agent of it, § 164.410(a)(2)), identifying each individual affected and giving the information the covered entity needs for its own notices

UT-04: the business associate's notice

SEC — Regulation S-K and Form 8-K

Form 8-K Item 1.05 — a registrant that experiences a cybersecurity incident it determines to be material describes the material aspects of its nature, scope and timing and its material impact or reasonably likely material impact, within four business days after the determination; the determination is made without unreasonable delay after discovery; information not yet determined is filed by amendment within four business days after it is determined or becomes available

UT-05 and UT-06: Item 1.05 and its Instructions

SEC — Regulation S-K and Form 8-K

Form 8-K General Instruction B.1 — a report is due within four business days after the event; if the event occurs on a Saturday, Sunday or a day the Commission is closed, the four business days begin on, and include, the first business day after

UT-05: the four business days and how a non-business day is counted

NYDFS — 23 NYCRR Part 500

§ 500.17(a) — notify the Superintendent electronically as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider, and provide requested information and updates promptly

UT-07: the 72-hour notice

NYDFS — 23 NYCRR Part 500

§ 500.17(c) — notify the Superintendent within 24 hours of an extortion payment made in connection with a cybersecurity event, and within 30 days give a written description of the reasons the payment was necessary, the alternatives considered, the diligence performed to find alternatives, and the diligence performed to ensure compliance with applicable rules, including those of the Office of Foreign Assets Control

UT-08: the 24-hour notice and the 30-day written description

FTC — Safeguards Rule, 16 CFR Part 314

§ 314.4(j) — notify the Federal Trade Commission as soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers; the notice gives the institution's contact details, the types of information, the date or date range, the number of consumers, a general description, and whether a law enforcement official has determined that public notice would impede an investigation or harm national security

UT-10: the Commission's notice and its content

FTC — Health Breach Notification Rule, 16 CFR Part 318

§ 318.5 — the methods of notice: written notice to individuals (email only if the individual chose it), substitute notice where contact details for ten or more individuals are out of date, notice to media for 500 or more residents of a State, and notice to the Commission in the way its website sets out

UT-11: the methods of notice

FTC — Health Breach Notification Rule, 16 CFR Part 318

§ 318.6 — what the notice says: what happened, with the dates of the breach and of its discovery and any third parties that acquired the information; the types of unsecured identifiable health information involved; the steps individuals should take; what the entity is doing; and contact procedures with at least two of a toll-free number, an email address, a website, an option within the application and a postal address

UT-11: what the notice says

State breach notification law (examples)

New York General Business Law § 899-aa — notice to affected New York residents within 30 days after the breach was discovered; the person or business also notifies the State attorney general, the department of state and the division of state police, and the department of financial services if it is a covered entity under 23 NYCRR 500.1; a HIPAA covered entity that notifies the Secretary of Health and Human Services also notifies the attorney general within five business days of doing so; where more than 5,000 New York residents are notified at one time, the consumer reporting agencies are notified too. This is one State's rule, given as an example; every other State has its own

UT-09: one State's rule, as an example

State breach notification law (examples)

California Civil Code § 1798.82 — notice to affected California residents within 30 calendar days of discovery or notification of the breach, with extensions for law enforcement needs and to determine the scope of the breach; for a breach affecting more than 500 California residents, a sample copy of the notice to the Attorney General within 15 calendar days of notifying residents. Read on 20 October 2026 in the Legislature's chaptered text of SB 446 (Chapter 319, Statutes of 2025, approved 3 October 2025); this section as amended takes effect on 1 January 2026, as California statutes do unless they say otherwise. Confirm the current text. This is one State's rule, given as an example; every other State has its own

UT-09: a second State's rule, as an example

Discovery

The first day a breach is known, or with reasonable diligence would have been known, to anyone in the workforce or any agent other than the person who committed it (45 CFR 164.404(a)(2)).

Materiality determination

A registrant's decision, made without unreasonable delay after discovery, that an incident is material; the four business days of Form 8-K Item 1.05 run from it.

Business associate

A person or organisation that handles protected health information for a covered entity, or provides certain services to it.

Fact base

The one record every notice is drafted from (RN-11), with the US fields FB-20 to FB-26.

Unsecured protected health information

Protected health information not made unusable, unreadable or indecipherable to unauthorised people by a method the Secretary specifies in guidance (45 CFR 164.402).

UT-nn, RD-nn, CT-nn, RN-nn

A template of this set; a reporting duty of P09's Incident Classification, Severity & Escalation Matrix; a message of P09's Incident Communications Template Set; a rule of the Regulatory Notification Operating Procedure.