The Sixty-Day Rule for Health Information

The federal health rule is the most precisely drafted clock in this field. It fixes a single outer limit of sixty calendar days, defines the event that starts it, and states who carries the burden of showing the deadline was met. The precision is useful because the surrounding state statutes are anything but uniform, and an entity subject to both has one federal number it can rely on and a range of state numbers it cannot.

Discovery, and the diligence standard attached to it

A breach is treated as discovered on the first day on which it is known to the covered entity, or on which it would have been known by exercising reasonable diligence. That second branch does most of the work. It converts discovery from a fact about what management was told into a judgment about what a reasonably diligent organization would have noticed, which means an unread alert or an unexamined log can fix the date retrospectively.

Attribution is broad. The entity is deemed to have knowledge if the breach is known, or by reasonable diligence would have been known, to any person other than the one who committed it, provided that person is a workforce member or an agent determined under the federal common law of agency. A contractor acting as an agent is inside the circle. The consequence is that the sixty days may already have been running for some time before the incident reaches anyone whose job it is to count.

The rule also fixes the same discovery definition for the media provision and for reporting to the Secretary, so a single date governs all three obligations rather than each running from its own event. A business associate is treated the same way in its own provision, with knowledge attributed to any employee, officer or other agent other than the person who committed the breach. The practical effect is that an entity defending its timing has to reconstruct not when it decided a breach had occurred, but the earliest moment at which anyone inside the organization had, or should have had, the facts.

The outer limit and the standard that sits inside it

Notification to each affected individual must be provided without unreasonable delay and in no case later than sixty calendar days after discovery. The two requirements are cumulative. Sixty days is the point beyond which no justification is entertained, not an allowance the entity may spend at will, and the same pairing appears in the media provision and in the parallel duty owed by a business associate.

Only one provision suspends the limit. Where a law enforcement official states that notification would impede a criminal investigation or cause damage to national security, the notice is delayed for the period specified in a written statement, or for no more than thirty days from an oral statement unless a written one arrives inside that window. That mechanism is examined in the law enforcement delay and how the clock resumes.

The five hundred threshold and the annual log

Two separate five hundred thresholds operate, and they are counted differently. Media notice turns on more than five hundred residents of a single state or jurisdiction, so a national incident may cross the line in three states and not in the rest. Reporting to the Secretary turns on five hundred or more individuals in total, without regard to where they live.

Below that total, the entity maintains a log or other documentation of the breaches and reports them to the Secretary not later than sixty days after the end of each calendar year, for breaches discovered during the preceding year. The log defers only the report to the Secretary. Individual notice remains due on the ordinary sixty-day clock, and the media provision is unaffected. An entity that treats a small breach as a logging matter and skips the individual letters has misread which obligation the log replaces.

What the notice says and how it is delivered

The content elements are fixed: a brief description of what happened, including the date of the breach and the date of discovery if known; the types of information involved; the steps individuals should take to protect themselves; a description of what the entity is doing to investigate, mitigate and protect against further breaches; and contact procedures including a toll-free number, an email address, a website or a postal address. The notification must be written in plain language.

Written notice goes by first-class mail to the last known address, or by electronic mail where the individual has agreed to it and has not withdrawn the agreement. Where contact information is insufficient or out of date for ten or more individuals, substitute notice requires either a conspicuous posting for ninety days on the home page of the entity's website or conspicuous notice in major print or broadcast media where the affected people likely reside, together with a toll-free number active for at least ninety days. For fewer than ten, an alternative written form, telephone or other means will do.

Two smaller rules sit alongside the main method. Where the entity knows an individual has died and holds an address for the next of kin or personal representative, written notice goes there instead, and substitute notice is not required if that address is itself insufficient. And in a case the entity judges urgent because of possible imminent misuse, it may add telephone or other contact on top of the written notice rather than in place of it. Neither provision changes the sixty days; both change what the entity has to be able to show it did inside them.

Who has to prove the deadline was met

The rule assigns the burden expressly. In the event of a use or disclosure in violation of the privacy subpart, the covered entity or business associate carries the burden of demonstrating that all notifications were made as required, or that the use or disclosure did not amount to a breach as defined. That allocation is what makes the risk assessment a document rather than a conclusion, since an incident file with no assessment leaves the presumption of compromise unrebutted. The record-keeping side of that duty is treated in documenting a decision not to notify.

The same allocation shapes how the sixty days is defended. The evidence that matters is the internal record of when the incident became known within the organization, which is why the definitional question examined in what counts as a breach and the discovery question are worked through together rather than in sequence.