Know your breach notification deadlines to the day.

When the clock starts: the day of discovery

Every deadline in the HIPAA Breach Notification Rule runs from one moment: the day the breach is discovered. The rule, at 45 CFR 164.404(a)(2), defines that day precisely. A breach is treated as discovered on the first day it is known to the organization, or the first day it would have been known by exercising reasonable diligence. Just as important, the breach is treated as known to the organization if any workforce member or agent, other than the person who caused the breach, knew or reasonably should have known about it. In other words, the clock does not politely wait until the news climbs the org chart to the privacy officer. If a help-desk technician saw the alert in March, the organization discovered the breach in March, even if leadership only heard about it in May.

This is why the discovery date, and not the incident date, is the input that drives this calculator. An attacker may have been inside a system for months before anyone noticed, but the 60-day clock does not start at intrusion. It starts at detection, real or constructive. The practical takeaway is that the speed of your monitoring and the clarity of internal escalation affect how much time remains for analysis and notice. A delay between workforce discovery and escalation does not restart the federal clock, so incident procedures should route reports promptly to the people responsible for breach analysis and notification.

Notice to individuals: the core 60-day deadline

The central obligation, and the one the calculator surfaces first, is notice to the affected individuals. Under 45 CFR 164.404(b), a covered entity must notify each individual whose unsecured protected health information was, or is reasonably believed to have been, involved in the breach. The deadline is without unreasonable delay and in no case later than 60 calendar days after discovery. Notice normally goes by first-class mail to the individual's last known address, or by email if the individual previously agreed to electronic notice. When you lack current contact information for ten or more individuals, the rule requires substitute notice, such as a conspicuous posting on your website for 90 days or notice in major print or broadcast media in the area.

The content of the notice is prescribed, not freeform. It must describe what happened and the date of the breach and its discovery, the types of information involved, the steps individuals should take to protect themselves, what the organization is doing to investigate and mitigate and prevent recurrence, and how to ask questions, including a toll-free number, email, website, or postal address. Writing that letter well takes time, legal review, and coordination with whatever credit monitoring or remediation you offer, which is one more reason the 60 days fills up faster than teams expect. The calculator dates the outer limit so you can work backward to when drafting and approval actually need to start.

The HHS and media thresholds are not the same

The total number of affected individuals determines which HHS reporting timeline applies. A breach affecting 500 or more individuals nationwide must be reported to the HHS Secretary contemporaneously with individual notice and no later than 60 days after discovery. A breach affecting fewer than 500 individuals follows the log and year-end reporting rule in 45 CFR 164.408(c).

Media notice uses different language and geography. Section 164.406 applies when a breach affects more than 500 residents of one State or jurisdiction. A nationwide total of exactly 500 triggers the contemporaneous HHS timeline but cannot trigger the media rule. A larger nationwide count may still fall below the media threshold in every jurisdiction. This calculator uses the nationwide total for HHS and flags the media question only when that total is high enough to make the separate test possible.

Notice to HHS: two very different deadlines

Reporting to the Secretary of Health and Human Services, handled through the Office for Civil Rights breach portal, runs on one of two timelines depending entirely on that 500 threshold. For a breach affecting 500 or more individuals, 45 CFR 164.408(b) requires you to notify the Secretary contemporaneously with the notice to individuals and in no case later than 60 days after discovery. HHS publishes information about reported breaches affecting 500 or more individuals on its breach portal.

For breaches affecting fewer than 500 individuals, 45 CFR 164.408(c) takes a different approach. You are not required to report each small breach to HHS within 60 days. Instead the covered entity must maintain a log of all breaches discovered during the calendar year and notify the Secretary no later than 60 days after the end of the calendar year. The calculator computes that year-end-plus-60 date for you when the affected count is below 500. The important distinction is that the year-end HHS timeline applies only to the HHS report. Individual notice for a small breach still runs on the same 60-day clock as a large one, and you should record each small breach in your log when it happens rather than scrambling to reconstruct a year of incidents the following February.

Notice to the media: a separate geographic test

Media notification under 45 CFR 164.406 applies only when a breach affects more than 500 residents of one State or jurisdiction. When that test is met, the covered entity must notify prominent media outlets serving that area, without unreasonable delay and no later than 60 days after discovery. The rule does not prescribe one universal communication format, so the entity should identify outlets that serve the affected area and confirm its approach with counsel. This is distinct from substitute individual notice under 45 CFR 164.404(d).

When the total affected population exceeds 500, the calculator asks for the largest number of affected residents in one State or jurisdiction. It shows media notice as applicable only when that geographic count is more than 500. Confirm the count and affected area before relying on the result.

Business associates: a separate clock that a contract may shorten

If you are a business associate rather than a covered entity, your obligation is different and the calculator reflects it. Under 45 CFR 164.410, a business associate that discovers a breach of unsecured protected health information must notify the covered entity, without unreasonable delay and no later than 60 days after discovery. The notice must identify each individual whose information was or is believed to have been involved, to the extent possible, and provide the other information the covered entity needs to make its own notifications. The business associate generally does not notify patients, HHS, or the media directly; it hands the covered entity what it needs to do so.

The federal outer limit is 60 days, but a business associate agreement may require earlier notice. When the agreement sets a shorter window, the parties must account for both regulatory and contractual duties. Review those terms before an incident and follow the applicable earlier requirement.

Before any clock runs: is it even a reportable breach?

Before using any date in this calculator, determine whether the incident involves unsecured PHI and whether it meets the definition of breach. Section 164.402 contains three exceptions. If no exception applies, an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless the organization demonstrates a low probability that the PHI was compromised through a four-factor assessment. The factors address the nature and extent of the PHI, the unauthorized person, whether the PHI was acquired or viewed, and the extent of mitigation.

The three exceptions cover limited circumstances involving good-faith workforce access, certain inadvertent disclosures between authorized people, and disclosures where the recipient could not reasonably retain the information. Encryption removes data from unsecured-PHI status only when it uses an HHS-specified method that renders the information unusable, unreadable, or indecipherable and the confidential process or key was not also compromised. Keep a contemporaneous record of the facts, any exception, the four factors when used, and the resulting decision. This calculator does not make that legal determination.

Turning the deadlines into a plan

Federal outer-limit dates help assign owners and plan several possible notice streams under time pressure. Use the calculator after identifying the discovery date: enter that date, set the nationwide affected count, and review the dates and conditional media check. Then account for the rule's no-unreasonable-delay standard, state law, contractual duties, fact development, legal review, and operational lead time. A worked example shows why the dates matter. Say a clinic discovers on March 1 that a vendor exposed records for 1,200 patients in a single state. The calculator shows April 30 as the federal outer limit for individual, HHS, and media notice. That date does not authorize waiting until then. The response may require confirmation of scope, an executive briefing, legal review of the letter, a vendor for printing and mailing, a call center for questions, and coordination of media notice. Assign owners and sequence that work based on the facts.

Preparation cannot guarantee that an incident will not occur, but it can reduce preventable handling errors and shorten the time between discovery and escalation. Use a risk analysis to prioritize safeguards, give workforce members a clear reporting process, document role-relevant training, and assign owners for each notice stream before an incident. Those controls support a faster, better documented response without treating training as a substitute for technical safeguards, vendor oversight, or legal review.