Business Associate Breach: Avoid the 60-Day Deadline Trap

Business associates (BAs) play a critical role in healthcare operations, managing everything from billing and IT services to cloud storage and data analytics. But with access to protected health information (PHI) comes serious legal responsibility. Under HIPAA’s Breach Notification Rule, section 164.410 specifically requires business associates to promptly notify covered entities (CEs) when a breach of unsecured PHI occurs. This guide offers a clear, actionable roadmap for BAs particularly small and midsize vendors on how to comply with 164.410, avoid regulatory penalties, and maintain trusted partnerships with covered entities.

When a healthcare-related data breach happens, the focus is often on the provider. But in today’s digital ecosystem, many breaches originate from business associates: third-party vendors entrusted with PHI. HIPAA recognizes this reality and imposes direct obligations on BAs under the Health Information Technology for Economic and Clinical Health (HITECH) Act and HIPAA’s implementing rules.

Specifically, 45 CFR 164.410 mandates that a business associate must notify its covered entity client whenever there is a breach of unsecured PHI. This responsibility is time-sensitive and legally binding. Failure to act quickly and appropriately not only damages relationships but also triggers regulatory scrutiny, fines, and reputational harm.

This article demystifies 164.410 and outlines step-by-step procedures for breach reporting, tailored to BAs of all sizes.

Understanding the Business Associate Breach Notification Requirement (164.410)

HIPAA defines a business associate as any entity that performs activities or functions on behalf of a covered entity involving the use or disclosure of PHI. This includes:

• Billing companies

• IT service providers

• Cloud storage vendors

• EHR contractors

• Medical transcription services

• Legal, accounting, or data analytics firms

Under 45 CFR 164.410, business associates are required to:

“…notify the covered entity of the breach without unreasonable delay, and in no case later than 60 calendar days after discovery of the breach.”

Discovery occurs on the first day the breach is known (or should have been known) by the BA or its workforce through reasonable diligence.

What qualifies as a Breach?

A breach is generally any unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises the privacy or security of the data.

Unsecured PHI refers to PHI that has not been made unusable, unreadable, or indecipherable to unauthorized individuals, typically via encryption or destruction as defined by HHS guidance.

A breach does not include:

• Unintentional access by a workforce member acting in good faith and within the scope of authority

• Inadvertent disclosures between authorized individuals at the same organization

• When the recipient could not reasonably retain the information

Nonetheless, when in doubt, the BA should err on the side of notification and conduct a proper breach risk assessment.

Regulators enforce 45 CFR § 164.410 through OCR breach investigations, compliance reviews following reported incidents, and downstream audits triggered by covered entity notifications. Enforcement reviews focus on when the business associate discovered the breach, whether reasonable diligence was exercised, and whether notification to the covered entity occurred without unreasonable delay. OCR examines incident timelines, internal escalation procedures, and supporting documentation to determine whether notification obligations were met within the regulatory 60-day outer limit.

The Four Key Elements of Breach Notification Under 164.410

When notifying the covered entity, a business associate must include the following elements to the extent possible:

1. Identification of Individuals

• A list (or the number) of affected individuals

• Sufficient detail to allow the covered entity to carry out its own notification obligations

2. Description of Breach Circumstances

• What happened (e.g., malware attack, lost laptop, email misdirected)

• When it happened

• When it was discovered

3. Types of PHI Involved

• Whether names, Social Security numbers, date of birth, diagnoses, medications, etc. were included

• Whether the PHI was encrypted or otherwise secured

4. Mitigation Efforts and Response

• What steps were taken to contain the breach

• Efforts to mitigate harm to affected individuals

• Preventative steps implemented to avoid recurrence

If all the information is not available immediately, the BA must provide details as they become available without unreasonable delay.

A Step-by-Step Guide for Business Associates

Step 1: Detect and Contain the Incident

• Activate your internal incident response protocol immediately upon suspicion

• Isolate affected systems (e.g., disconnect from network, quarantine files)

• Begin documenting the event from the moment of discovery

Step 2: Conduct a Breach Risk Assessment

Use the four factors from the Breach Notification Rule to determine whether an incident qualifies as a reportable breach:

1. Nature and extent of PHI involved

2. Unauthorized person who accessed or received the PHI

3. Whether PHI was actually acquired or viewed

4. Mitigation measures taken

If there’s more than a low probability of compromise, a breach notification is required.

Step 3: Notify the Covered Entity

Once a breach is determined:

• Notify the covered entity in writing (usually email and/or formal letter per the Business Associate Agreement)

• Provide the four required elements listed above

• Notify as soon as possible, but no later than 60 calendar days after discovery

Tip: Don’t wait for the full investigation to conclude before notifying. Initial notification can be followed by updates as more details become available.

Step 4: Cooperate in the Covered Entity’s Notification Duties

Under 164.404, the covered entity is responsible for notifying:

• Affected individuals

• HHS (via the Breach Portal)

• Media (if more than 500 residents are affected in one jurisdiction)

But the BA is expected to support the process, providing:

• Full details for the individual notifications

• Evidence of mitigation efforts

• Technical guidance on the breach origin and impact

In 2022, a small billing company acting as a business associate for a rural health clinic inadvertently emailed a PHI spreadsheet to the wrong insurance provider. The file contained names, dates of birth, and CPT codes. The error was discovered the same day, and the recipient confirmed the deletion. However, the BA waited 3 weeks to notify the clinic due to internal confusion over whether the breach was reportable.

Upon OCR audit, the covered entity was cited for late notification, and both organizations had to enter corrective action plans. The root cause? The business associate did not have a formal breach notification workflow or training.

Lesson: Time is of the essence early notification protects both the BA and the covered entity.

• Implement a written Breach Response Plan

• Maintain a log of all incidents (even non-reportable ones)

• Train staff annually on HIPAA breach awareness

• Use role-based access controls and audit logs

• Sign and review Business Associate Agreements (BAAs) annually

• Work closely with legal counsel and the CE’s compliance team during incidents

• 45 CFR § 164.410 - Notification by a Business Associate

• HHS Breach Notification Guidance

• OCR Breach Reporting Portal

• HITECH Act – Section, 13402

Business associates are no longer behind-the-scenes players in HIPAA compliance, they are fully accountable for protecting PHI and reporting breaches. Section 164.410 places a clear and enforceable obligation on BAs to notify covered entities promptly and thoroughly.

The best way to comply isn’t to memorize regulations, but to build a reliable workflow, train your team, and document every step. Doing so not only helps you avoid fines, but positions your organization as a trusted, security-conscious partner in the healthcare ecosystem.

If you’re a BA without a formal breach notification policy in place, the time to act is now. Your covered entities and your reputation depend on it.

Effective compliance with 45 CFR § 164.410 requires a repeatable system that integrates detection, escalation, legal review, and notification into standard operations. Regulators evaluate whether breach notification is embedded into governance structures, supported by trained personnel, and validated through documentation that demonstrates reasonable diligence. Business associates that operationalize breach notification as a system function reduce enforcement exposure and downstream liability.