What it asks for. The HIPAA Breach Notification Rule, at 45 CFR 164.400 to 164.414, requires covered entities to notify affected individuals following a breach of unsecured protected health information, and to notify the US Department of Health and Human Services. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media. Business associates must notify the covered entity. An unauthorised use or disclosure is presumed to be a breach unless a risk assessment shows a low probability of compromise.
In practice. Organisations have procedures to assess incidents using the required risk factors, notify individuals without unreasonable delay and within the 60 day outer limit, and maintain a log of smaller breaches for annual reporting. Evidence includes risk assessments, notification letters, HHS submissions and business associate agreements with reporting terms.
Common gaps. Organisations sometimes treat 60 days as the target rather than the maximum. Encryption that meets HHS guidance can remove the duty, but is often not documented well enough to rely on.