The 60-Day Deadline: A Guide to Timely Breach Notification Without Unreasonable Delay (45 CFR § 164.404(b))

Under the HIPAA Breach Notification Rule, covered entities are required to notify affected individuals when unsecured protected health information (PHI) is compromised. Per 45 CFR § 164.404(b), this notice must be provided “without unreasonable delay” and no later than 60 calendar days after discovering the breach. This seemingly straightforward timeline has become one of the most cited issues in OCR enforcement cases. For small practices, understanding what counts as “discovery,” what constitutes an unreasonable delay, and how to meet the deadline is critical to avoiding penalties and preserving patient trust.

Why the 60-Day Rule Exists

The 60-day rule was established to ensure that patients are notified promptly when their PHI has been impermissibly disclosed or accessed. Timely notification allows individuals to take protective steps, such as monitoring credit reports or contacting insurers, while also holding providers accountable for securing sensitive data.

The 60-day clock begins when the breach is discovered, not when the investigation is completed. This puts pressure on covered entities to act quickly and efficiently once an incident is suspected or confirmed.

OCR considers delays that result from internal miscommunication, prolonged forensic investigations, or inaction to be unreasonable. As such, practices must be proactive and prepared.

What the Regulation Says: A Closer Look at 45 CFR § 164.404(b)

The text of the regulation states:

“Except as provided in § 164.412 of this section, a covered entity shall provide the notification required under this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.”

This mandates two key things:

1. A maximum of 60 calendar days from the date the breach is discovered

2. A shorter time frame, if feasible, to avoid unreasonable delay

Covered entities must not wait until day 60 unless absolutely necessary.

In 2018, a medical billing company affiliated with a small family medicine practice experienced a data breach after an employee’s email credentials were compromised. The breach was detected internally, but due to delays in coordinating with the vendor and a lack of urgency within the practice, patients were not notified until nearly four months after the initial discovery. This delay far exceeded the 60-day notification requirement mandated by HIPAA.

The Office for Civil Rights (OCR) launched an inquiry into the incident and determined that, although there was no evidence of malicious intent, the delay in notification was unjustified and violated HIPAA’s breach notification rule. As a result, the practice was fined $75,000 and required to enter into a corrective action plan. This plan mandated the establishment of a formal breach response timeline and comprehensive retraining of staff on timely breach identification and notification procedures.

Lesson Learned: Delaying notification until after an investigation concludes or due to vendor coordination issues does not stop the 60-day clock. Prompt action and clear internal processes are essential regulatory requirements to protect patient privacy and maintain compliance.

How to Count the 60 Days Correctly

• Start Date: The date any workforce member first knows, or reasonably should have known, that a breach occurred

• End Date: When the notification is actually sent to affected individuals

If the BA is the CE’s agent, discovery may be imputed earlier (when the BA knew or should have known); otherwise, the CE’s clock generally begins upon BA notice.

Example

• Breach discovered: March 1

• Notification deadline: April 30

If April 30 falls on a weekend or holiday, the notification must still be issued by that date. There are no extensions granted under HIPAA.

Step 1: Detect and Escalate Internally

• Train all staff to report suspicious activity or privacy concerns immediately

• Establish a simple internal form or communication channel for breach escalation

Step 2: Initiate a Preliminary Investigation Within 24 Hours

• Conduct a risk assessment per 45 CFR § 164.402 to determine if notification is required

• Document the findings and escalate to your privacy officer or compliance lead

Step 3: Notify Patients Within the Required Timeframe

• Draft the breach notification in plain language

• Include all elements required under § 164.404(c):

• Description of the breach

• Types of information involved

• Steps the patient should take

• What your practice is doing to address it

• Contact information

Step 4: Track Timing and Retain Records

• Keep a breach timeline and log the date of discovery, investigation steps, and notification issuance

• Retain all documentation for six years, as required by HIPAA
  

Pitfall 1: Waiting for Full Forensic Results Before Notifying Patients

Many practices hesitate to send notices until a full forensic investigation is complete. However, this can take weeks or even months, pushing the timeline beyond 60 days.

How to Avoid It: You don’t need full certainty to notify. Use the best available information at the time, and make it clear that your notice may be updated if additional facts emerge.

Pitfall 2: Misunderstanding What Counts as “Discovery”

Some providers mistakenly believe the 60-day clock starts once legal or compliance teams confirm the breach. In reality, it starts when any member of your workforce knows, or reasonably should have known, about the incident.

How to Avoid It: Educate all staff on breach reporting. Implement policies that treat reports from any employee as potential breach discoveries unless proven otherwise.

Pitfall 3: Treating the 60-Day Mark as a Goal Instead of a Limit

Waiting until day 60, even without justifiable cause, may still count as an unreasonable delay. OCR interprets the 60-day window as an outer limit, not a grace period.

How to Avoid It: Set internal deadlines to notify individuals within 30 days of discovery unless there are documented, legitimate reasons for delay.

Pitfall 4: Lack of Written Procedures and Breach Response Plans

In small practices, breach response is often ad hoc. Without documented procedures, time is lost figuring out what to do next.

How to Avoid It: Develop a breach response policy that includes timelines, responsible roles, and templates for communication.

Pitfall 5: Incomplete or Vague Notices

Even if you send the notice on time, leaving out required information can lead to penalties. Notices must explain the nature of the breach, what data was involved, and what the affected individuals should do.

How to Avoid It: Use a checklist aligned with 45 CFR § 164.404(c) when drafting each notice. Have it reviewed by legal counsel or a HIPAA compliance officer.

Pitfall 6: Ignoring the Role of Business Associates

When a breach occurs due to a business associate’s mistake, covered entities sometimes delay notification while the associate investigates.

How to Avoid It: Your 60-day deadline still applies. Establish clear breach reporting timelines in all Business Associate Agreements (BAAs), including a clause requiring notification within 10 days of discovery.

1. HHS Breach Notification Rule Overview

2. OCR Breach Notification Rule Guidance

3. HHS Breach Reporting Portal
   

The 60-day deadline for breach notification is not merely a technicality, it is a foundational requirement under the HIPAA Breach Notification Rule. This timeframe ensures that affected individuals are informed promptly about potential risks to their privacy, and it reinforces provider accountability. Failing to meet this deadline can result in investigations, penalties, and reputational harm.

For small healthcare practices, compliance with the 60-day rule is not only possible but practical, when the right systems are in place. Timely notification begins with internal awareness and a proactive compliance mindset. Staff must be trained to recognize and report potential breaches immediately, triggering a well-defined and documented response process.

Establishing clear timelines, maintaining pre-approved templates, and assigning responsibilities are key steps to staying ahead of the deadline. By treating every incident seriously and acting quickly, practices can protect both patients and their legal standing.

Next Steps for Your Practice:

• Review your current breach notification policy and procedures

• Train staff to escalate possible breaches immediately

• Create a breach response timeline tool that triggers deadlines for notice

• Maintain templates for patient letters and documentation logs

• Monitor changes in HHS guidance and update your procedures annually

Maintaining compliance is an ongoing process. By adopting a HITECH regulatory solution, your practice can track obligations in real time, complete risk assessments with confidence, and stay audit-ready, demonstrating proactive risk management and reinforcing trust with payers and patients.