HIPAA Breach Notification Letters: The 60-Day Clock, the 164.404(c) Content List, and the Evidence That Satisfies 164.414

HIPAA breach notification requirements establish who must be notified, what a letter must contain, and when notice is due. A defensible process records the discovery date, verifies each notice element, documents delivery, and preserves evidence for review.

The governing federal rules are in 45 CFR Part 164, Subpart D. The statutory breach-notification provision is 42 U.S.C. § 17932, enacted as section 13402 of the HITECH Act.

The 60-day clock starts at discovery

Under 45 CFR § 164.404(a), a covered entity must notify each individual whose unsecured protected health information (PHI) was, or is reasonably believed to have been, accessed, acquired, used, or disclosed because of a breach.

Discovery occurs on the first day the breach is known, or would have been known through reasonable diligence. Knowledge is attributed to the covered entity when a workforce member or agent other than the person committing the breach knows, or should have known, of it.

Notice must be provided without unreasonable delay and no later than 60 calendar days after discovery, except where a law-enforcement delay under § 164.412 applies. The clock runs from discovery, not from completion of the investigation. An investigation can continue while the organization prepares notice and gathers details.

The rule permits notice in one or more mailings as information becomes available. Each mailing should be recorded with its date, recipient scope, content version, and relationship to earlier communications. A current state law tracker can help teams review additional jurisdictional requirements.

The § 164.404(c) content list

Individual notice must be written in plain language and include these elements, to the extent possible:

1. What happened. Provide a brief description, including the breach date and discovery date if known.
2. What PHI was involved. Describe the types of unsecured PHI, such as name, address, date of birth, account information, or diagnosis.
3. What individuals should do. Explain steps they can take to protect themselves from potential harm.
4. What the organization is doing. Briefly describe the investigation, harm mitigation, and measures to protect against further breaches.
5. How to get information. Provide contact procedures, including at least one of a toll-free telephone number, email address, website, or postal address.

Retain the approved letter and a content review that maps each required element to the final text. If information is not available when the first notice is sent, document what was unknown and track any follow-up mailing.

Delivery methods and additional notices

The federal rule specifies written notice by first-class mail to the individual's last known address. Email is permitted if the individual agreed to electronic notice and has not withdrawn that agreement. For a deceased individual, written notice goes by first-class mail to the next of kin or personal representative when the covered entity has the required address.

First-class mail is the rule's standard postal method. Certified Mail is not required by HIPAA's breach notification rule. It can be a defensible evidence choice when an organization wants an additional postal record. A mailing record supports proof of notice, but it does not independently establish that the envelope contained the required letter or that the content was complete. Link postal evidence to the retained final notice, recipient record, and mailing event. For a related discussion, see proof of mailing vs. proof of notice.

When contact information is insufficient or out of date:

• Fewer than 10 individuals: Use alternative written notice, telephone, or another means.
• 10 or more individuals: Use a conspicuous website home-page posting for 90 days or conspicuous notice in major print or broadcast media serving the areas where affected individuals likely reside. Include a toll-free number active for at least 90 days.
• Deceased individual's contact: Substitute notice is not required solely because contact information for the next of kin or personal representative is insufficient or out of date.

For possible imminent misuse, a covered entity can provide additional information by telephone or other appropriate means.

Media, Secretary, and business associate notices

Under § 164.406, a breach involving more than 500 residents of a State or jurisdiction requires notice to prominent media outlets serving that area. The notice is due without unreasonable delay and no later than 60 calendar days after discovery, subject to § 164.412. Its content must meet the § 164.404(c) requirements.

Under § 164.408, a breach involving 500 or more individuals requires notice to the HHS Secretary contemporaneously with individual notice, using the method specified by HHS. For a breach involving fewer than 500 individuals, maintain a log or other documentation and report it to the Secretary no later than 60 days after the end of the calendar year in which it was discovered.

A business associate must notify the covered entity following discovery of a breach, without unreasonable delay and no later than 60 calendar days after discovery. The notice must identify affected individuals to the extent possible and provide other available information needed for individual notice.

The evidence burden under § 164.414

Section 164.414 places the burden of proof on the covered entity or business associate, as applicable, to demonstrate either that all required notifications were made or that the use or disclosure did not constitute a breach. The section also connects breach-notification activity to specified administrative requirements in § 164.530.

The operational record should allow a reviewer to reconstruct the decision and notification sequence. A mailing receipt alone does not establish that the right recipients received a complete notice on time. A robust audit trail for legal notices ties the discovery, decision, content, recipient, delivery, and follow-up evidence together.

Evidence checklist

Maintain a controlled incident file containing:

• Discovery record: The first-known date, how the event became known, relevant reports, and the reasonable-diligence analysis.
• Scope and decision record: The affected population, PHI types, breach determination, and any documented basis for concluding that notification was not required.
• Deadline control: The discovery date, calculated 60-day deadline, assigned owner, review dates, and any applicable state-law deadlines.
• Notice content: The approved draft, final version, plain-language review, and a checklist mapping the letter to each § 164.404(c) element.
• Recipient and address records: The mailing list, source of each address, validation steps, and documented list updates.
• Mailing evidence: The vendor handoff, mailing date, service selected, transaction or tracking identifiers, and available postal records. Keep these linked to the corresponding final notice.
• Exception handling: Returned-mail records, address research, substitute-notice decisions, posting or media evidence, and any corrective mailing.
• Other notifications: Media notice copies and submission evidence, plus HHS Secretary filing confirmations or the annual log and filing record.
• Delay documentation: Any § 164.412 law-enforcement statement. For an oral statement, document the official's identity and the statement, and track the temporary delay, which cannot exceed 30 days unless a written statement is provided during that period.
• Retention and access: The record owner, access controls, retention classification, and any hold or disposition decision.

A notice log supports legal notice tracking by recording each action as a dated event. It should capture separate individual mailings as information becomes available, as well as regulator filings, return handling, and follow-up decisions. See the notice record retention guide for related record controls.

Where teams get this wrong

• Starting the clock after the investigation: The federal deadline runs from discovery. Investigation completion does not reset it.
• Treating Certified Mail as mandatory: The HIPAA rule specifies first-class mail as its postal method. Certified Mail is optional, not a substitute for content and recipient evidence.
• Keeping a letter without its mailing record: A retained draft does not show which version was sent, to whom, or when.
• Using one notice date for every action: Additional mailings, substitute notices, media notices, and HHS filings have distinct evidence and timing records.
• Applying only the federal deadline: State breach laws can impose shorter clocks and additional content or regulator-notice requirements.

HIPAA's notice process establishes the federal baseline. Review the applicable State requirements and incident facts before finalizing deadlines, recipients, and delivery methods.

This article provides general compliance information, not legal advice.