Record details
- Classification
- guidance
- Published date
- September 14, 2009
- Source
- HHS Office for Civil Rights
What this record says
The HHS breach reporting page distinguishes reporting obligations based on whether a breach affects 500 or more individuals or fewer than 500 individuals. Teams should preserve the official report, the underlying risk assessment, notification evidence, and the facts used to determine timing. A public breach listing is a reporting record, not by itself a complete account of root cause or compliance.
Who should review this
- Covered entities
- Business associates
- Privacy and incident response teams
Core concepts
- Breach Notification Rule
- Secretary notification
- unsecured PHI
- incident documentation
References
- Primary source HHS Office for Civil Rights