Fact · Voice privacy and security
60calendar days
Under HIPAA's Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovering a breach.
Checked against its source on October 17, 2026
In the source's own words
“without unreasonable delay and in no case later than 60 calendar days after discovery of a breach”
45 CFR 164.404: Notification to individuals, Legal Information Institute, Cornell Law School (reproducing the Code of Federal Regulations), n.d., § 164.404(b).
Open the original- What it measures
- The clock starts at discovery of a breach of unsecured protected health information. A dictation tool with an unencrypted recording or a misdirected transcript can start that clock.
- What it does not show
- Sixty days is the outer limit, not a target: the rule requires notice without unreasonable delay. Other federal and state rules may add duties.