# HIPAA Breach Notification Rule — Covered Entities and Business Associates

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_bc05a03d9c-hipaa-breach-notification-rule-covered-entities-and-business-associates
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Data Breach Notification](https://support.icompaas.com/support/solutions/62000112443) › [Topics](https://support.icompaas.com/support/solutions/folders/f_gen_62000112443_topics)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

45 CFR §§ 164.400–164.414

### Definition

A "breach" under HIPAA is the _acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule which compromises the security or privacy of the PHI_. There is a presumption of breach unless you can document, via a 4-factor risk assessment, a low probability of compromise.

### The 4-factor risk assessment

1.  Nature and extent of the PHI involved (types of identifiers, likelihood of re-identification).
2.  Unauthorised person who used or received the PHI.
3.  Whether the PHI was actually acquired or viewed.
4.  Extent to which the risk has been mitigated.

### Notification windows

-   **Affected individuals** — without unreasonable delay and no later than **60 calendar days** from discovery (first-class mail; email if the individual has agreed).
-   **HHS Secretary** — < 500 individuals: annual report by 60 days after the end of the calendar year. ≥ 500 individuals: **contemporaneously with individual notice**, via the OCR breach portal.
-   **Media** — ≥ 500 individuals in a single state or jurisdiction: prominent media outlets serving that area.
-   **Business Associates** notify the Covered Entity without unreasonable delay; the contract dictates the exact window (often within 24 hours).

### Content requirements

Each notice must describe what happened, types of PHI involved, steps individuals can take, what the entity is doing to investigate/mitigate, and contact procedures.

### The iCompaas BA workflow

For Business Associates: when an incident is opened, iCompaas tracks the per-Covered-Entity notification deadlines (as set in each BAA), pre-fills the discovery details and acquired PHI categories from your incident notes, and produces a per-CE notification draft.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Breach notification under Articles 33 and 34: the 72-hour clock, what to record and when to notify individuals.
- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The HIPAA Breach Notification Rule timelines and thresholds for covered entities and business associates.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): Breach reporting duties to the Data Protection Board and affected Data Principals under the DPDP Rules.