The HIPAA breach clock: what starts it and what it requires

When the clock starts

Under the Breach Notification Rule, a breach is treated as discovered on the first day it is known to the covered entity, or would have been known by exercising reasonable diligence. Knowledge by any workforce member other than the person who committed the breach counts. That means the clock can start when a front-line employee notices a misdirected fax, well before compliance hears about it.

A working timeline

The rule sets the outer limit. The milestones below are a suggested internal schedule that leaves time for notice drafting and review; they are not regulatory deadlines.

1. 1
   Day 0: discovery

   ·Known, or would have been known with reasonable diligence
2. 2
   First 24 hours: triage

   ·Contain and isolate

   ·Log the incident and the discovery date
3. 3
   Days 1 to 15: risk assessment

   ·Four-factor risk assessment

   ·Decision documented either way
4. 4
   Days 16 to 45: if reportable

   ·Draft notices

   ·Complete forensics and mitigation
5. 5
   Within 60 days of discovery

   ·Affected individuals

   ·HHS at the same time if 500 or more are affected

   ·Media if more than 500 residents of a state

   ·Under 500: annual report to HHS within 60 days of year end

Documenting the four-factor assessment

Record each factor and the evidence behind it. If the conclusion is a low probability of compromise, this record is what supports not notifying.

Presumption and the risk assessment

An impermissible use or disclosure of PHI is presumed to be a breach unless the organization demonstrates, through a documented risk assessment, a low probability that the PHI has been compromised. The assessment considers at least four factors: the nature and extent of the PHI involved; the unauthorized person who used it or received it; whether the PHI was actually acquired or viewed; and the extent to which the risk has been mitigated.

The assessment and its conclusion should be documented whether or not notification follows. It is the record that justifies a decision not to notify.

Who must be notified, and by when

Affected individuals: without unreasonable delay and no later than sixty calendar days after discovery. The Secretary of HHS: for breaches affecting 500 or more individuals, contemporaneously with individual notice; for fewer than 500, in an annual log submitted within sixty days after the end of the calendar year. Prominent media: when more than 500 residents of a state or jurisdiction are affected. A business associate must notify the covered entity without unreasonable delay and within sixty days of its own discovery; many BAAs shorten that period.

State breach laws may impose shorter deadlines or additional recipients. Track both.

Operational habits that help

Make reporting a suspected incident easy and non-punitive, so discovery reaches compliance on day one rather than day twenty. Record the discovery date separately from the report date. Start the risk assessment the same day. Keep the notification log, templates, and mailing records together with the incident so the whole response can be produced as one record.

Closing the loop

Is it working?

Suspected incidents reach compliance on the day they are discovered, and risk assessments start the same day.

Can you show it?

Keep the discovery date, the four-factor assessment, the notification decision, and the notification log together in one record.