HIPAA Breach Notification Rule 164.410: Business associate notification to the covered entity

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, identifying to the extent possible each individual whose unsecured PHI was breached and providing the information the covered entity needs for its own 164.404, 164.406 and 164.408 notifications, per 164.410.