HIPAA Breach Notification Rule 164.404: Notification to affected individuals, timing and content

Following discovery of a breach, a covered entity must notify each affected individual without unreasonable delay and in no case later than 60 calendar days after discovery, by first-class mail (or email if the individual agreed) and, for urgent cases involving possible imminent misuse, by telephone or other means in addition to written notice, with substitute notice (website posting or major media) where contact information is insufficient or out of date for ten or more individuals, and content meeting 164.404(c): a brief description of the breach, the types of information involved, steps individuals should take, what the entity is doing to investigate, mitigate and prevent recurrence, and contact information.