Breach intelligence

HIPAA Breach Lessons

Learn from authoritative HIPAA breach reporting guidance and source-backed incident lessons.

Reviewed August 2026

Published records

Breach reporting timelines depend on the number of people affected

HHS explains when covered entities must notify the Secretary after a breach of unsecured protected health information.

Classification: guidance · Published September 14, 2009 · Source: HHS Office for Civil Rights

Read the HHS Office for Civil Rights source

Topics: Breach Notification Rule, Secretary notification, unsecured PHI, incident documentation

How to use this index

Each record separates the classification, published date, affected audience, and source-backed explanation. Confirm the linked primary source before using an item to guide a legal, privacy, security, or incident-response decision.

Explore related intelligence

HIPAA Regulatory Updates — Track verified HIPAA proposals, final rules, guidance, and legal-status changes from authoritative sources.
HIPAA Enforcement Actions — Review source-backed HIPAA enforcement outcomes and the operational lessons they provide.

Browse the complete HIPAA knowledge hub or read the editorial sourcing standard.