Find & Ask › Federal › this rule
45 CFR 164.406 — HIPAA Breach Notification Rule: Notification to the media
FederalregulationU.S. Department of Health and Human Services (HHS), Office for Civil Rights· effective 2009-09-23
What this rule requires your agency to do
- 1A covered entity must provide the media notification without unreasonable delay and in no case later than 60 calendar days after discovery of the breach, except as provided in § 164.412 (§ 164.406(b)).(45 CFR 164.406 — HIPAA Breach Notification Rule: Notification to the media)
- 2The media notification must meet the content requirements of § 164.404(c) (§ 164.406(c)).(45 CFR 164.406 — HIPAA Breach Notification Rule: Notification to the media)
- 3For a breach of unsecured PHI involving more than 500 residents of a State or jurisdiction, a covered entity must notify prominent media outlets serving that State or jurisdiction following discovery of the breach (§ 164.406(a)).(45 CFR 164.406 — HIPAA Breach Notification Rule: Notification to the media)
Applies to: cross-cutting
Requires a covered entity to notify prominent media outlets serving a State or jurisdiction following the discovery of a breach of unsecured PHI involving more than 500 residents of that State or jurisdiction. The notification must be provided without unreasonable delay and no later than 60 calendar days after discovery, and must meet the content requirements of § 164.404(c).
Regulatory information, not legal advice — always confirm against the cited official source. Verification reduces error; it does not certify compliance.