844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Category: HIPAA Breach Rule

    • Key Facts About HIPAA Compliance – Breach Reporting Requirements

      Our series is designed to explain best practices about HIPAA compliance, HIPAA settlements, and the various requirements an organization must have in place under the HIPAA Security & Privacy Rules.

      When does a HIPAA Breach Affecting Fewer than 500 Individuals Need to be Reported by?

      If a breach of unsecured protected health information affects fewer than 500 individuals, a covered entity must notify the Secretary of the breach within 60 days of the end of the calendar year in which the breach was discovered. That makes the reporting date March 1, 2025.

      A covered entity is not required to wait until the end of the calendar year to report breaches affecting fewer than 500 individuals; a covered entity may report such breaches at the time they are discovered. The covered entity may report all its breaches affecting fewer than 500 individuals on one date, but the covered entity must complete a separate notice for each breach incident. The covered entity must submit the notice electronically and complete all the fields of the breach notification form.

      If your organization needs to report this type of breach notification, here is the link to submit the notification.

      Colington Consulting | HIPAA Compliance, Risk Assessment & Management

      Allow our team of regulatory experts to assess your organization’s compliance with the HIPAA Security and Privacy Rules, the risk assessment process, and breach notification requirements. We offer customized services to meet specific requirements for your organization, making HIPAA compliance strategies effective and efficient. For a free, initial consultation to see how we can assist your organization, give our office a call at 844.740.7100.

      Helping Organizations Achieve HIPAA Compliance™

    • HIPAA Breach Rule Notification Requirements

      What are the HIPAA Breach Rule Notification Requirements?

      Following a breach of unsecured protected health information, covered entities must provide notification of the breach to affected individuals, the Secretary, and, in certain circumstances, to the media. In addition, business associates must notify covered entities if a breach occurs at or by the business associate. All notifications must be submitted to the U.S. Department of Health and Human Services (HHS) using their web reporting portal.

      Breaches Affecting 500 or More Individuals

      If a breach of unsecured protected health information affects 500 or more individuals, a covered entity must notify HHS of the breach without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach.

      Covered entities must notify affected individuals following the discovery of a breach of unsecured protected health information. In addition to notifying the affected individuals, covered entities that experience a breach affecting more than 500 residents of a State or jurisdiction are required to provide notice to prominent media outlets serving the State or jurisdiction.

      Breaches Affecting Fewer than 500 Individuals

      If a breach of unsecured protected health information affects fewer than 500 individuals, a covered entity must notify HHS of the breach within 60 days of the end of the calendar year in which the breach was discovered. A covered entity is not required to wait until the end of the calendar year to report breaches affecting fewer than 500 individuals; a covered entity may report such breaches at the time they are discovered. The covered entity may report all of its breaches affecting fewer than 500 individuals on one date, but the covered entity must complete a separate notice for each breach incident.

      In addition, covered entities must notify affected individuals following the discovery of a breach of unsecured protected health information.

      Need Help With Your HIPAA Compliance Program?

      HIPAA violations often stem from small, overlooked gaps in daily operations. Don’t wait for a breach to trigger a federal investigation.

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your practice.

      • Updated on June 9, 2026 and Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.