HIPAA Basics for Providers: Privacy, Security, & Breach …

What steps you took to reduce the risk after the incident You must notify authorities of most breaches without reasonable delay and no later than 60 days after discovering the breach. Submit notifications of smaller breaches affecting fewer than 500 patients to HHS annually. The Breach Notification Rule also requires your business associates to notify you of breaches at or by the business …