[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:hipaa\u002Fbreach-notification":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"hipaa","breach-notification","§164.400","HIPAA Breach Notification Rule",25,"US Department of Health and Human Services (HHS)","**What it asks for.** The HIPAA Breach Notification Rule, at 45 CFR 164.400 to 164.414, requires covered entities to notify affected individuals following a breach of unsecured protected health information, and to notify the US Department of Health and Human Services. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media. Business associates must notify the covered entity. An unauthorised use or disclosure is presumed to be a breach unless a risk assessment shows a low probability of compromise.\n\n**In practice.** Organisations have procedures to assess incidents using the required risk factors, notify individuals without unreasonable delay and within the 60 day outer limit, and maintain a log of smaller breaches for annual reporting. Evidence includes risk assessments, notification letters, HHS submissions and business associate agreements with reporting terms.\n\n**Common gaps.** Organisations sometimes treat 60 days as the target rather than the maximum. Encryption that meets HHS guidance can remove the duty, but is often not documented well enough to rely on.",null,"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-45\u002Fsubtitle-A\u002Fsubchapter-C\u002Fpart-164","Read the rule (eCFR)","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"social-engineering-and-ransomware-expose-250000-healthcare-patients","Social Engineering and Ransomware Expose 250,000 Healthcare Patients","2026-10-05T14:21:11.44+00:00",{"slug":23,"title":24,"published_at":25},"healthcare-provider-exposes-280k-patient-records-in-june-2026-breach","Healthcare Provider Exposes 280K Patient Records in June 2026 Breach","2026-09-16T12:22:04.316+00:00",{"slug":27,"title":28,"published_at":29},"veradigm-patient-data-breach-traced-to-third-party-vendor-ransomware-attack","Veradigm Patient Data Breach Traced to Third-Party Vendor Ransomware Attack","2026-09-09T16:20:22.662+00:00",{"slug":31,"title":32,"published_at":33},"95-million-patients-exposed-in-aesto-health-software-breach","9.5 Million Patients Exposed in Aesto Health Software Breach","2026-09-01T20:20:24.194+00:00",{"slug":35,"title":36,"published_at":37},"novocure-breach-exposes-1400-cancer-patients-data-via-unauthorized-system-access","Novocure Breach Exposes 1,400+ Cancer Patients' Data via Unauthorized System Access","2026-09-01T16:20:58.282+00:00",{"slug":39,"title":40,"published_at":41},"ransomware-breach-exposes-nutex-health-patient-and-financial-data","Ransomware Breach Exposes Nutex Health Patient and Financial Data","2026-09-01T12:21:15.192+00:00",{"slug":43,"title":44,"published_at":45},"95-million-records-exposed-in-aesto-health-aws-breach","9.5 Million Records Exposed in Aesto Health AWS Breach","2026-09-01T10:20:53.447+00:00",{"slug":47,"title":48,"published_at":49},"mckesson-breach-exposes-284m-records-in-shinyhunters-extortion-attack","McKesson Breach Exposes 284M Records in ShinyHunters Extortion Attack","2026-08-31T14:20:56.827+00:00",{"slug":51,"title":52,"published_at":53},"nutex-health-breach-exposes-patient-and-employee-data-via-unauthorized-server-access","Nutex Health Breach Exposes Patient and Employee Data via Unauthorized Server Access","2026-08-26T08:20:21.673+00:00",{"slug":55,"title":56,"published_at":57},"lacma-breach-exposes-ssns-and-medical-data-detected-months-after-incident","LACMA Breach Exposes SSNs and Medical Data, Detected Months After Incident","2026-08-25T22:20:20.664+00:00",{"slug":59,"title":60,"published_at":61},"nutex-health-cyberattack-exposes-patient-and-employee-data","Nutex Health Cyberattack Exposes Patient and Employee Data","2026-08-25T16:20:41.452+00:00",{"slug":63,"title":64,"published_at":65},"carecloud-aws-breach-exposes-37m-patients-due-to-cloud-security-gaps","CareCloud AWS Breach Exposes 3.7M Patients Due to Cloud Security Gaps","2026-08-19T08:21:46.134+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",15,{"slug":73,"name":74,"problem":75,"stories":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",12,{"slug":78,"name":79,"problem":80,"stories":81},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",8,{"slug":83,"name":84,"problem":85,"stories":86},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",6,{"slug":88,"name":89,"problem":90,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,{"slug":93,"name":94,"problem":95,"stories":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,101,107,112,117,123,128,133],{"family":5,"item":98,"code":99,"title":100,"together":9},"security-rule","Security Rule","HIPAA Security Rule",{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","3","Control 3","Data Protection",20,{"family":102,"item":108,"code":109,"title":110,"together":111},"6","Control 6","Access Control Management",18,{"family":113,"item":114,"code":115,"title":116,"together":71},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":118,"item":119,"code":120,"title":121,"together":122},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",14,{"family":124,"item":125,"code":126,"title":127,"together":122},"nist-800-53","ac-2","AC-2","Account Management",{"family":124,"item":129,"code":130,"title":131,"together":132},"si-4","SI-4","System Monitoring",13,{"family":113,"item":134,"code":135,"title":136,"together":76},"32","Article 32","Security of processing"]