A Small Practice Guide to Providing Substitute Breach Notices When You Can't Reach an Individual (45 CFR § 164.404(d)(2))

HIPAA requires covered entities to notify individuals following a breach of unsecured Protected Health Information (PHI). But what if contact information is missing or outdated?

Under 45 CFR 164.404(d)(2), healthcare providers must use substitute notification methods when they are unable to reach ten or more affected individuals. For small practices, understanding how and when to issue substitute notice is not just a technicality it’s a critical component of compliance and maintaining patient trust.

This guide walks you through step-by-step strategies to implement substitute notification properly, avoid legal pitfalls, and keep your practice protected.

Why Substitute Notification Matters Under HIPAA and HITECH

The Breach Notification Rule and the HITECH Framework

The HITECH Act established mandatory breach notification requirements for covered entities and business associates, now codified under HIPAA at 45 CFR §§ 164.400–414. These requirements were introduced to increase transparency and empower patients when their data is compromised.

In particular, 45 CFR § 164.404(d)(2) requires substitute notification when standard notification cannot be accomplished due to insufficient or outdated contact information for ten or more affected individuals. Practices must act quickly and use methods that are reasonably calculated to reach affected individuals.

Failure to follow these procedures can lead to federal investigations, monetary penalties, and reputational harm, even if the breach originated from a third party.

To qualify for substitute notice, the following must apply:

• A breach involves unsecured PHI

• You lack valid contact information (postal or email) for 10 or more individuals. If you use substitute notice for 10 or more individuals, include a toll-free phone number that remains active for at least 90 days, as required by §164.404(d)(2)(ii)(B)

Notification must still be delivered within 60 days of discovering the breach

HITECH-Compliant Substitute Notification Options

Option 1: Website Posting

• Prominently display the notice on the practice’s homepage

• Link must be visible and accessible

• Must remain live for at least 90 days

• Include a toll-free number patients can call for more information, also available for 90 days

Option 2: Media Publication

• Use a major print or broadcast media outlet in the geographic area where affected individuals reside

• Must include all required elements of breach notification (see 45 CFR § 164.404(c))

• Must also reference the toll-free number active for at least 90 days

Optional Enhancement: Telephone or In-Person Outreach

For breaches involving fewer than 10 unreachable individuals, alternative methods such as phone calls or in-person notification are acceptable under HIPAA.

In 2021, a multi-location pediatric practice discovered that its patient billing system had been compromised, exposing the unsecured PHI of 327 patients. For 42 individuals, mailed notices were returned due to outdated addresses, and no valid email addresses were on file.

The practice responded by:

• Posting a clear breach notice on its homepage for 90 days

• Publishing a notice in a major regional newspaper

• Establishing a toll-free support line and assigning staff to respond to inquiries

OCR conducted a post-breach review and found the response was compliant, citing the practice’s prompt substitute notification and documented internal procedures as mitigating factors.

Lessons Learned:

• Substitute notice is not optional, it’s a regulatory requirement

• Website postings must be accessible and time-stamped

• Hotline documentation can be used to prove patient outreach efforts

Step 1: Identify Unreachable Individuals

• Confirm how many notices were undeliverable (e.g., returned mail, bounced emails)

• Maintain a list with contact attempt outcomes

Step 2: Choose the Appropriate Method

• For 10 or more: implement web and/or media substitute notice

• For fewer than 10: consider phone calls, in-person visits, or certified mail

Step 3: Develop and Publish the Notice

Ensure the substitute notice includes:

• Date and description of the breach

• Types of PHI involved

• Mitigation efforts taken

• Recommended steps individuals should take

• Contact info including a toll-free number (open ≥ 90 days)

Step 4: Retain Documentation

• Save screenshots of your website posting and/or copies of media publications

• Log calls made to the toll-free line

• Maintain this documentation for at least 6 years

Common Pitfalls and How to Avoid Them

Pitfall 1: Assuming Substitute Notice Is Optional

Some practices overlook substitute notice, assuming that the lack of contact information excuses them from further notification. This is incorrect. HIPAA requires a substitute method when the threshold of 10 or more unreachable individuals is met.

Avoid It: Build substitute notice procedures into your breach response policy. Assign responsibility to a specific staff role.

Pitfall 2: Website Posting That’s Hard to Find or Too Brief

Posting a banner or link that’s hidden in a footer, or removing it prematurely, violates the rule. HIPAA requires that the notice be “prominently posted” and accessible for at least 90 days.

Avoid It: Place the notice directly on your homepage or include a bold “Breach Notification” link above the fold. Use analytics to confirm visibility.

Pitfall 3: Incomplete or Vague Breach Notices

Not including sufficient detail about the breach, data types involved, or patient protection steps can result in noncompliance.

Avoid It: Use a template that incorporates the five required notification elements listed under § 164.404(c). Review content with legal counsel if needed.

Pitfall 4: Failing to Provide or Maintain a Toll-Free Contact Number

The regulation requires a working toll-free number for inquiries, open during normal business hours for 90 days. Practices often forget to establish this or let the line lapse early.

Avoid It: Use a call-tracking system or forward calls to a designated HIPAA-trained staff member. Log all patient inquiries for documentation.

Pitfall 5: Inadequate Documentation

Without proof of publication, call logs, or breach notices, your practice may be found noncompliant, even if you followed the procedures.

Avoid It: Take and store screenshots, retain media invoices, and archive voicemail or inquiry logs for no less than six years.

1. U.S. Department of Health and Human Services (HHS): Breach Notification Guidance

2. National Institute of Standards and Technology (NIST): Guide to Storage Encryption Technologies (SP 800-111)

3. HIPAA Journal: HIPAA Encryption Requirements Explained

Substitute breach notification is not a workaround, it is a regulated process under HIPAA designed to ensure transparency and uphold patient rights when direct contact is not possible. For small practices, establishing a compliant substitute notice procedure is essential to maintaining continuity in breach response and limiting legal and reputational exposure.

Next Steps for Your Practice

1. Review and update your breach response policy to include substitute notification procedures.
   Ensure your policies outline when and how substitute notices should be used, including thresholds and documentation requirements.

2. Train your team on how to implement and document web and media notices.
   Staff should understand the difference between individual and substitute notification, and how to properly execute both according to HIPAA standards.

3. Bookmark official HHS guidance and keep a breach notice template on file.
   Having ready-to-use templates for website postings or media announcements helps you respond quickly and consistently in compliance with regulations.

4. Conduct an annual audit of your patient contact data.
   Keep your patient records up to date to minimize the number of unreachable individuals in the event of a breach.

For added assurance, invest in a compliance management tool designed for HITECH. These solutions centralize regulatory tracking, provide continuous risk evaluation, and ensure your practice is prepared for audits by addressing weak points before they escalate, reflecting a proactive commitment to compliance.