Government and public statistics
45 CFR 164.404: Notification to individuals
Legal Information Institute, Cornell Law School (reproducing the Code of Federal Regulations), n.d.
Read the originalRead on October 17, 2026
- What it is
- The HIPAA Breach Notification Rule section that sets when a covered entity must tell affected individuals about a breach of unsecured protected health information, and the outer time limit for doing so.
- How much weight it carries
- The federal regulation as reproduced by the Cornell Legal Information Institute. The reproduction is unofficial, but the wording is the regulation's.
Facts taken from this source
- Under HIPAA's Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovering a breach.
“without unreasonable delay and in no case later than 60 calendar days after discovery of a breach” (§ 164.404(b))