When Law Enforcement Asks You to Delay a Breach Notification: A Guide to the Rules in 45 CFR § 164.412

Executive Summary

The HIPAA Breach Notification Rule generally requires covered entities to notify affected individuals, HHS, and in some cases the media, within 60 days of discovering a breach of unsecured protected health information (PHI). The law enforcement delay applies to all required HIPAA breach notifications, including notices to affected individuals, HHS, and, when applicable, the media. However, when law enforcement involvement intersects with breach response, the rules shift. Under 45 CFR § 164.412, covered entities may temporarily delay notification if law enforcement determines it would impede a criminal investigation or jeopardize national security. This article breaks down when and how to apply this exception, how to remain compliant during the delay, and what your small practice should do when working with law enforcement in breach scenarios.

Introduction

Notifying patients of a HIPAA breach is a legal obligation and ethical responsibility. But in some cases, such as cyberattacks or insider threats, law enforcement may intervene and ask the covered entity to hold off on notifying affected individuals. The reasoning? Early notification could compromise an active investigation, tip off the perpetrator, or interfere with evidence collection.

To account for these rare but critical situations, § 164.412 of the HIPAA Breach Notification Rule permits a law enforcement delay. The delay must meet strict criteria and follow a defined process. For small practices that receive such a request, it’s essential to document everything, understand the limits of the exception, and resume notifications as soon as allowed.

Understanding § 164.412: The Law Enforcement Delay Rule

Section 164.412 allows a covered entity to delay breach notification if:

1. A law enforcement official states in writing that notifying individuals, HHS, or the media would impede a criminal investigation or cause damage to national security; or
2. A verbal request is made, and the entity documents it and limits the delay to no more than 30 days, unless a written statement is received within that time.

Once the written request is received, the delay must last only as long as specified by the law enforcement agency.

What Must Be Included in a Written Delay Request?

A valid written request from law enforcement must include:

• The identity of the official or agency
• The reason for the delay (i.e., to avoid impeding an investigation)
• A time frame for the requested delay

After that time expires or if no further extension is granted, the covered entity must proceed with breach notification immediately, even if the 60-day clock has passed.

A Case Study: A Cyberattack, an FBI Request, and Delayed Notification

In 2022, a small cardiology practice in the Midwest discovered ransomware had compromised their electronic health records, affecting over 3,000 patients. Upon contacting the FBI, the practice was asked not to notify patients or the public until the agency could trace the origin of the attack and gather digital evidence.

The FBI promptly issued a written request for delayed notification under § 164.412, specifying a 45-day hold. The practice followed protocol: they suspended all breach communications, documented the request, and consulted their legal counsel.

After the 45-day period lapsed, the FBI did not request an extension, and the practice immediately sent patient notices, filed a breach report with HHS, and issued a media release.

Because the delay was well-documented, lawfully requested, and promptly ended, the Office for Civil Rights (OCR) found no violation, in a stark contrast to other cases where undocumented delays have resulted in penalties. This example shows how small practices can delay notifications legally and defensibly under § 164.412.

Key Rules for Delaying Notification Under § 164.412

• No self-determined delays: You cannot delay breach notification unless law enforcement specifically requests it.
• Written is preferred: A written request allows the delay to last as long as specified.
• Verbal is temporary: If the request is made orally, it must be documented and expires in 30 days unless replaced with a written request.
• Delays don’t remove the duty: You must resume breach notification immediately once the time period ends.
• Delays cannot be indefinite. Each delay must have a clear end date, as specified by law enforcement, and notifications must resume immediately once the authorized delay period ends.

What to Do When Law Enforcement Requests a Delay

When a healthcare practice experiences a data breach involving protected health information (PHI), the instinct is to notify affected patients as quickly as possible. However, there are situations where law enforcement may intervene and request a temporary delay in breach notifications to avoid compromising an ongoing investigation. Under HIPAA § 164.412, covered entities are permitted to comply with such requests but only if handled correctly. Here’s what small healthcare practices should do:

Step 1: Request Written Documentation

Always ask the law enforcement official to provide a written request clearly stating the reason for the delay and the specific duration. The request must come from an authorized official affiliated with a law enforcement agency (e.g., FBI, local police, federal prosecutor). Without written documentation, your legal ability to delay notification is limited.

Step 2: Document Verbal Requests Cautiously

If the official cannot provide immediate written documentation, you may honor a verbal request, but you must document it carefully. Record the name, title, and agency of the requester, the date and time of the conversation, the reason for the delay, and your planned follow-up. Note: A verbal request only allows a delay of up to 30 days, unless replaced by a formal written request.

Step 3: Suspend All Breach Notifications

Temporarily halt all breach notifications to individuals, the media, and the Department of Health and Human Services (HHS). Avoid discussing the breach publicly or including any references to it in emails, websites, or newsletters during the delay period.

Step 4: Monitor the Expiration Date

Track the expiration date of the delay closely. Once the delay period ends, whether it was 30 days for a verbal request or longer per written documentation, you must act immediately, even if that pushes you past HIPAA’s usual 60-day deadline for notification.

Step 5: Resume Notification and Reporting Promptly

As soon as the delay expires, send breach notifications to all affected individuals. Submit your breach report to HHS using the Breach Portal, and, if the breach affects more than 500 individuals in a single state, notify the media in compliance with HIPAA requirements. Prompt, complete action shows good faith and helps avoid enforcement penalties.

Common Pitfalls and Risk Areas

• Delaying notification without law enforcement involvement
• Failing to document a verbal request
• Extending a verbal delay beyond 30 days
• Assuming a phone call or casual conversation qualifies as a valid request
• Not resuming notifications immediately once the delay ends

Expert Tips for Small Practices

• Establish a breach response plan that includes a law enforcement delay protocol.
• Train staff to elevate all law enforcement requests to your Privacy Officer or legal counsel.
• If you receive a delay request, consult your legal team immediately to ensure compliance.
• Keep a copy of the law enforcement request (written or documented verbal) with your breach investigation file.
• Even during the delay, continue internal breach investigation and remediation efforts.

Simplified Law Enforcement Delay Checklist

Regulatory References and Official Guidance

• 45 CFR § 164.412 – Delay of Notification for Law Enforcement Purposes
• 45 CFR §§ 164.404–406 – HIPAA Breach Notification Requirements
• OCR Guidance on Breach Investigations
• DOJ Cybercrime Unit Guidance for Healthcare Providers
• HIPAA Enforcement Case Examples – HHS.gov

Concluding Recommendations and Next Steps

Law enforcement delay requests are rare but critical moments in a breach response. § 164.412 offers a narrow exception to HIPAA’s 60-day notification rule, but it must be handled precisely.

For small practices, the key is understanding that delays:

• Must be initiated by law enforcement
• Must be documented
• Cannot be indefinite
• Do not absolve you of your breach notification obligations

Responding effectively requires a mix of vigilance, documentation, and compliance timing. With the right preparation and protocols in place, your practice can meet both HIPAA and public safety obligations without falling into enforcement risk.