HITECH Act 13402d: Section 13402(d) and (g): notify without unreasonable delay and within 60 calendar days of discovery, with the burden of proof on the notifier; delay only at law enforcement request

All notifications required by the section are made without unreasonable delay and in no case later than 60 calendar days after discovery; the covered entity or business associate bears the burden of demonstrating that all notifications were made as required, including evidence of the necessity of any delay. A notification may be delayed only where a law enforcement official determines it would impede a criminal investigation or damage national security, in the manner of 45 CFR 164.528(a)(2).