When is a Breach "Discovered"? How HITECH's Clock Starts Ticking for Your Practice (45 CFR § 164.404(a)(2))

The HITECH Act imposes strict timelines on covered entities when notifying individuals of a breach involving unsecured protected health information (PHI). But the law doesn’t just say you must notify, it says you must do so within 60 calendar days of discovering the breach. Understanding exactly when a breach is considered "discovered" under 45 CFR § 164.404(a)(2) is crucial for small healthcare practices that want to remain compliant and avoid costly penalties. This guide breaks down the legal standard, explains the role of workforce awareness, and outlines actionable steps your practice can take to avoid misinterpreting the start of the clock.

What the Regulation Actually Says

45 CFR § 164.404(a)(2) states:

“A breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence, would have been known.”

This language is important because it introduces two key concepts:

• Actual knowledge of a breach

• Constructive knowledge, i.e., what the covered entity should have known with reasonable diligence

In simple terms, the breach notification clock doesn’t just start when your privacy officer confirms a breach, it starts when any workforce member becomes aware, or should have become aware, of the unauthorized access, acquisition, use, or disclosure of PHI.

Discovery does not require certainty that a breach has occurred. According to HHS guidance, “discovery” occurs when there is sufficient information to indicate that a potential breach happened. This means that:

• A front-desk employee who sees a patient file left in public view has, for legal purposes, discovered a potential breach.

• An IT technician who notices that a staff member’s login was used after hours by an unknown device has, in effect, triggered the breach clock.

OCR does not require malicious intent or verified data loss to start the timer, just reasonable evidence that PHI was improperly accessed or disclosed.

In 2017, a small pediatric clinic in the Southwest had an unencrypted email account compromised through a phishing scam. A nurse received a suspicious login alert but didn’t report it. Two weeks later, a patient noticed unusual insurance claims and contacted the clinic.

The clinic launched an internal investigation but delayed sending breach notifications until 90 days after the original alert. OCR determined that the nurse’s failure to act didn’t excuse the practice from the breach timeline. They were fined $80,000 for unreasonable delay and incomplete documentation.

Lesson Learned: Discovery occurs when any workforce member has knowledge, action or inaction doesn’t stop the clock. Small practices must ensure that every staff member understands their reporting obligations.

Per the regulation and HHS guidance, a breach is “discovered” when:

• Any employee or contractor of the covered entity knows of the breach

• There is enough evidence that a breach should reasonably have been known

• A business associate notifies the covered entity of a breach (triggering the entity’s own 60-day window)
  
  

This standard places the burden on covered entities to:

• Educate staff about recognizing and reporting privacy events

• Monitor systems and logs for signs of unauthorized access

• Maintain open channels for incident reporting
  

Step 1: Establish a Clear Definition of “Breach”

Include in your written HIPAA policies a simple definition of what qualifies as a breach under HITECH. Use real-world examples relevant to your practice, such as misplaced paper charts or shared login credentials.

Step 2: Train Every Staff Member on Their Role in Discovery

Make sure that all employees understand that they may be the first to discover a breach. Provide annual training with scenarios like:

• “You find patient test results left in the copier.”

• “A former employee still has login access.”

Ensure all training emphasizes that awareness equals discovery under the law.

Step 3: Create an Immediate Escalation Path

Designate specific individuals or a privacy team who must be contacted when a breach is suspected. Create an easy-to-use incident form or hotline for staff to report concerns without delay.

Step 4: Document the Discovery Date

As soon as a potential breach is reported, document:

• The name of the individual who reported it

• The date and time of the report

• The nature of the suspected breach

This timestamp is essential, it marks day one of the 60-day notification clock.

Step 5: Start a Breach Response Timeline

Track the following milestones:

• Discovery date

• Start of risk assessment

• Notification drafts

• Notification delivery date

Maintain this timeline in your breach incident log and retain it for at least six years.

This checklist ensures your practice correctly identifies when a breach is “discovered” and starts the 60-day notification clock under HITECH.

Common Pitfalls and How to Avoid Them

Pitfall 1: Assuming Discovery Happens Only After an Investigation,

Many practices mistakenly believe that discovery occurs after an internal or forensic investigation is complete. This misunderstanding leads to late notifications and compliance failures.

How to Avoid It: Start the breach clock at the moment any staff member becomes aware of the incident, not when final conclusions are reached. Investigate promptly, but don’t delay initiating notification procedures.

Pitfall 2: Failing to Train Staff on Their Legal Role in Discovery

In small practices, front-desk and clinical staff may not realize that their observations can legally trigger the breach timeline. This ignorance can delay reporting and notification.

How to Avoid It: Train all workforce members annually, using real examples. Reinforce that every team member plays a role in HIPAA compliance and breach discovery.

Pitfall 3: Ignoring IT and Security Logs

Automated systems often detect anomalies, like failed login attempts or unexpected file access. Ignoring these alerts may cause a practice to miss the true discovery date.

How to Avoid It: Assign someone to monitor logs weekly. Ensure that significant security alerts are reviewed and escalated without delay.

Pitfall 4: Delayed Notifications from Business Associates

When a breach occurs at the level of a billing vendor or IT provider, the covered entity still bears the responsibility for timely notification, even if the vendor took weeks to report it.

How to Avoid It: Require all Business Associate Agreements (BAAs) to include a clause mandating notification to you within 10 days of any breach.

Pitfall 5: Poor Documentation of Discovery

If OCR investigates, they will ask for records proving when and how the breach was discovered. Without documented evidence, you could be held accountable for a delay, even if you acted appropriately.

How to Avoid It: Create an incident response form that records the discovery date and all follow-up actions. Keep this as part of your official compliance log.

Pitfall 6: Underestimating Minor Incidents

Practices may dismiss events they view as harmless, like an employee emailing patient info to themselves, as non-breaches. If left unreported, these can escalate into HIPAA violations.

How to Avoid It: Treat all privacy or security incidents seriously. Use HHS’s risk assessment tool to determine whether notification is required. When in doubt, escalate.

References and Further Reading

1. HHS HIPAA Breach Notification Rule Summary

2. HHS Breach Discovery FAQ and Interpretive Guidance

3. OCR Enforcement Case Examples

Understanding when a breach is considered “discovered” is one of the most important elements of breach response planning. Under HITECH, discovery is not reserved for compliance officers, it applies to the entire workforce. For small practices, this means building a culture of immediate reporting and maintaining documentation that can withstand regulatory review.

Next Steps for Your Practice:

• Update your HIPAA policies to include a formal definition of breach discovery

• Train all workforce members on recognizing and reporting breaches

• Implement a documented breach response timeline tool

• Review and amend all Business Associate Agreements to include discovery-related obligations

• Maintain detailed breach incident logs with discovery dates clearly recorded

For added assurance, invest in a compliance management tool designed for HITECH. These solutions centralize regulatory tracking, provide continuous risk evaluation, and ensure your practice is prepared for audits by addressing weak points before they escalate, reflecting a proactive commitment to compliance.