# HHS Official Guidance Pages — Verbatim Snapshot Dataset

Retrieved: 2026-04-28

Source URLs:
- https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
- https://www.hhs.gov/hipaa/for-professionals/security/index.html
- https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

Notes:
- Content captured from browser accessibility snapshots to preserve visible text and linked URLs.
- Snapshot format includes page title, URL, event metadata, and an accessible tree with URL targets.

## Privacy Rule Page Snapshot

```text
Page Title: The HIPAA Privacy Rule | HHS.gov
URL: https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
Snapshot:
- generic [active] [ref=e1]:
- link "Skip to main content" [ref=e2] [cursor=pointer]:
- /url: "#main"
- generic [ref=e4]:
- region "Official government website" [ref=e5]:
- generic [ref=e8]:
- img "U.S. flag" [ref=e10]
- paragraph [ref=e12]: An official website of the United States government
- button "Here’s how you know" [ref=e13] [cursor=pointer]
- generic [ref=e19]:
- img "Freedom 250 banner logo" [ref=e20]
- link "Join HHS in Celebrating Freedom 250" [ref=e21] [cursor=pointer]:
- /url: /freedom250/index.html
- img [ref=e22]
- banner [ref=e24]:
- generic [ref=e25]:
- link "Home" [ref=e28] [cursor=pointer]:
- /url: /
- img [ref=e29]
- button "Menu" [ref=e115]
- generic [ref=e118]:
- navigation "breadcrumb-label-11031616818" [ref=e120]:
- generic [ref=e122]:
- generic [ref=e123]: Breadcrumb
- list [ref=e124]:
- listitem [ref=e125]:
- link "HHS" [ref=e126] [cursor=pointer]:
- /url: /
- listitem [ref=e127]:
- link "HIPAA Home" [ref=e128] [cursor=pointer]:
- /url: /hipaa/index.html
- listitem [ref=e129]:
- link "For Professionals" [ref=e130] [cursor=pointer]:
- /url: /hipaa/for-professionals/index.html
- listitem [ref=e131]: Privacy
- list [ref=e135]:
- listitem [ref=e136]:
- checkbox "Adjust Text Size" [ref=e137] [cursor=pointer]:
- img [ref=e138]
- listitem [ref=e139]:
- link "Print" [ref=e140] [cursor=pointer]:
- /url: "#"
- img [ref=e141]
- listitem [ref=e143]:
- button "Page sharing options" [ref=e144] [cursor=pointer]:
- img [ref=e145]
- generic [ref=e147]: Page sharing options
- main [ref=e148]:
- generic [ref=e152]:
- complementary [ref=e153]:
- button "Navigate to:" [ref=e156] [cursor=pointer]
- generic [ref=e157]:
- generic [ref=e160]:
- heading "The HIPAA Privacy Rule" [level=1] [ref=e161]
- article [ref=e162]:
- generic [ref=e163]:
- generic [ref=e167]:
- paragraph [ref=e168]: The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as “protected health information”) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization. The Rule also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections.
- paragraph [ref=e169]:
- text: The Privacy Rule is located at 45 CFR
- link "Part 160 , links to an external website" [ref=e170] [cursor=pointer]:
- /url: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160?toc=1
- text: Part 160
- generic [ref=e172]: ", links to an external website"
- text: and Subparts A and E of
- link "Part 164 , links to an external website" [ref=e173] [cursor=pointer]:
- /url: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
- text: Part 164
- generic [ref=e175]: ", links to an external website"
- text: .
- paragraph [ref=e176]:
- link "Click here to view the combined regulation text" [ref=e177] [cursor=pointer]:
- /url: /hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/index.html
- text: of all HIPAA Administrative Simplification Regulations found at 45 CFR 160, 162, and 164.
- heading "Privacy Rule History" [level=2] [ref=e178]
- list [ref=e179]:
- listitem [ref=e180]:
- text: April 26, 2024 -
- link "HIPAA Privacy Rule to Support Reproductive Health Care Privacy - Final Rule , links to an external website" [ref=e181] [cursor=pointer]:
- /url: https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy
- text: HIPAA Privacy Rule to Support Reproductive Health Care Privacy - Final Rule
- generic [ref=e183]: ", links to an external website"
- listitem [ref=e184]:
- text: April 17, 2023 -
- link "HIPAA Privacy Rule to Support Reproductive Health Care Privacy - Proposed Rule , links to an external website" [ref=e185] [cursor=pointer]:
- /url: https://www.federalregister.gov/documents/2023/04/17/2023-07517/hipaa-privacy-rule-to-support-reproductive-health-care-privacy
- text: HIPAA Privacy Rule to Support Reproductive Health Care Privacy - Proposed Rule
- generic [ref=e187]: ", links to an external website"
- listitem [ref=e188]:
- text: March 10, 2021 -
- link "Extension of Comment Period for Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement – Proposed Rule , links to an external website , opens in a new tab" [ref=e190] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2021-03-10/pdf/2021-05021.pdf
- text: Extension of Comment Period for Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement – Proposed Rule
- generic [ref=e192]: ", links to an external website"
- generic [ref=e193]: ", opens in a new tab"
- listitem [ref=e194]:
- text: January 21, 2021 -
- link "Modifications to the HIPAA Privacy Rule to Empower Patients, Improve Coordinated Care, and Reduce Regulatory Burdens - Proposed Rule , links to an external website , opens in a new tab" [ref=e196] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2021-01-21/pdf/2020-27157.pdf
- text: Modifications to the HIPAA Privacy Rule to Empower Patients, Improve Coordinated Care, and Reduce Regulatory Burdens - Proposed Rule
- generic [ref=e198]: ", links to an external website"
- generic [ref=e199]: ", opens in a new tab"
- listitem [ref=e200]:
- text: December 14, 2018 -
- link "Modifying the HIPAA Rules to Improve Coordinated Care - Request for Information , links to an external website , opens in a new tab" [ref=e202] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2018-12-14/pdf/2018-27162.pdf
- text: Modifying the HIPAA Rules to Improve Coordinated Care - Request for Information
- generic [ref=e204]: ", links to an external website"
- generic [ref=e205]: ", opens in a new tab"
- listitem [ref=e206]:
- text: January 6, 2016 -
- link "HIPAA Privacy Rule and the National Instant Criminal Background Check System (NICS) - Final Rule , links to an external website , opens in a new tab" [ref=e208] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2016-01-06/pdf/2015-33181.pdf
- text: HIPAA Privacy Rule and the National Instant Criminal Background Check System (NICS) - Final Rule
- generic [ref=e210]: ", links to an external website"
- generic [ref=e211]: ", opens in a new tab"
- listitem [ref=e212]:
- text: February 6, 2014 -
- link "Patients' Access to Test Reports Under the HIPAA Privacy Rule and the Clinical Laboratory Improvement Amendments of 1988 (CLIA) Program - Final Rule , links to an external website , opens in a new tab" [ref=e214] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2014-02-06/pdf/2014-02280.pdf
- text: Patients' Access to Test Reports Under the HIPAA Privacy Rule and the Clinical Laboratory Improvement Amendments of 1988 (CLIA) Program - Final Rule
- generic [ref=e216]: ", links to an external website"
- generic [ref=e217]: ", opens in a new tab"
- listitem [ref=e218]:
- text: January 7, 2014 -
- link "HIPAA Privacy Rule and NICS - Proposed Rule , links to an external website , opens in a new tab" [ref=e220] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2014-01-07/pdf/2014-00055.pdf
- text: HIPAA Privacy Rule and NICS - Proposed Rule
- generic [ref=e222]: ", links to an external website"
- generic [ref=e223]: ", opens in a new tab"
- listitem [ref=e224]:
- text: April 23, 2013 -
- link "HIPAA Privacy Rule and NICS - Advance Notice of Proposed Rulemaking , links to an external website , opens in a new tab" [ref=e226] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2013-04-23/pdf/2013-09602.pdf
- text: HIPAA Privacy Rule and NICS - Advance Notice of Proposed Rulemaking
- generic [ref=e228]: ", links to an external website"
- generic [ref=e229]: ", opens in a new tab"
- listitem [ref=e230]:
- text: January 25, 2013 -
- link "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications - Final Rule , links to an external website , opens in a new tab" [ref=e232] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2013-01-25/pdf/2013-01073.pdf
- text: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications - Final Rule
- generic [ref=e234]: ", links to an external website"
- generic [ref=e235]: ", opens in a new tab"
- text: (The "Omnibus HIPAA Final Rule")
- listitem [ref=e236]:
- text: September 14, 2011 -
- link "Patients' Access to Test Reports Under the HIPAA Privacy Rule and CLIA Program - Proposed Rule , links to an external website , opens in a new tab" [ref=e238] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2011-09-14/pdf/2011-23525.pdf
- text: Patients' Access to Test Reports Under the HIPAA Privacy Rule and CLIA Program - Proposed Rule
- generic [ref=e240]: ", links to an external website"
- generic [ref=e241]: ", opens in a new tab"
- listitem [ref=e242]:
- text: May 31, 2011 -
- link "HIPAA Privacy Rule Accounting of Disclosures Under the HITECH Act - Proposed Rule , links to an external website , opens in a new tab" [ref=e244] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2011-05-31/pdf/2011-13297.pdf
- text: HIPAA Privacy Rule Accounting of Disclosures Under the HITECH Act - Proposed Rule
- generic [ref=e246]: ", links to an external website"
- generic [ref=e247]: ", opens in a new tab"
- listitem [ref=e248]:
- text: July 14, 2010 -
- link "Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act - Proposed Rule , links to an external website , opens in a new tab" [ref=e250] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2010-07-14/pdf/2010-16718.pdf
- text: Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act - Proposed Rule
- generic [ref=e252]: ", links to an external website"
- generic [ref=e253]: ", opens in a new tab"
- listitem [ref=e254]:
- text: May 3, 2010 -
- link "HIPAA Privacy Rule Accounting of Disclosures Under the HITECH Act - Request for Information , links to an external website , opens in a new tab" [ref=e256] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2010-05-03/pdf/2010-10054.pdf
- text: HIPAA Privacy Rule Accounting of Disclosures Under the HITECH Act - Request for Information
- generic [ref=e258]: ", links to an external website"
- generic [ref=e259]: ", opens in a new tab"
- listitem [ref=e260]:
- text: October 7, 2009 -
- link "HIPAA Privacy Rule; Modifications Under the Genetic Information Nondiscrimination Act - Proposed Rule , opens in a new tab" [ref=e262] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/understanding/special/genetic/ginanprm.pdf
- text: HIPAA Privacy Rule; Modifications Under the Genetic Information Nondiscrimination Act - Proposed Rule
- generic [ref=e263]: ", opens in a new tab"
- listitem [ref=e264]:
- text: August 14, 2002 -
- link "Modifications to the HIPAA Privacy Rule - Final Rule , opens in a new tab" [ref=e266] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/privruletxt.txt
- text: Modifications to the HIPAA Privacy Rule - Final Rule
- generic [ref=e267]: ", opens in a new tab"
- text: (
- link "PDF , opens in a new tab" [ref=e269] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/privrulepd.pdf
- text: PDF
- generic [ref=e270]: ", opens in a new tab"
- text: )
- listitem [ref=e271]:
- text: March 27, 2002 -
- link "Modifications to the HIPAA Privacy Rule - Proposed Rule , opens in a new tab" [ref=e273] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/propmods.txt
- text: Modifications to the HIPAA Privacy Rule - Proposed Rule
- generic [ref=e274]: ", opens in a new tab"
- text: (
- link "PDF , opens in a new tab" [ref=e276] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/2002proposedmods.pdf
- text: PDF
- generic [ref=e277]: ", opens in a new tab"
- text: )
- listitem [ref=e278]:
- text: February 28, 2001 -
- link "Request for Comments on December 28, 2000, Final HIPAA Privacy Rule , opens in a new tab" [ref=e280] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/comment.txt
- text: Request for Comments on December 28, 2000, Final HIPAA Privacy Rule
- generic [ref=e281]: ", opens in a new tab"
- text: (
- link "PDF , links to an external website , opens in a new tab" [ref=e283] [cursor=pointer]:
- /url: https://www.gpo.gov/fdsys/pkg/FR-2001-02-28/pdf/01-4811.pdf
- text: PDF
- generic [ref=e285]: ", links to an external website"
- generic [ref=e286]: ", opens in a new tab"
- text: )
- listitem [ref=e287]:
- text: February 26, 2001 -
- link "Correction of Effective and Compliance Dates of the Final HIPAA Privacy Rule , opens in a new tab" [ref=e289] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/dates.txt
- text: Correction of Effective and Compliance Dates of the Final HIPAA Privacy Rule
- generic [ref=e290]: ", opens in a new tab"
- text: (
- link "PDF , opens in a new tab" [ref=e292] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/dates.pdf
- text: PDF
- generic [ref=e293]: ", opens in a new tab"
- text: )
- listitem [ref=e294]:
- text: December 29, 2000 -
- link "Technical Corrections to the Final HIPAA Privacy Rule , opens in a new tab" [ref=e296] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/pvcfix01.txt
- text: Technical Corrections to the Final HIPAA Privacy Rule
- generic [ref=e297]: ", opens in a new tab"
- text: (
- link "PDF , opens in a new tab" [ref=e299] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/pvcfix01.pdf
- text: PDF
- generic [ref=e300]: ", opens in a new tab"
- text: )
- listitem [ref=e301]:
- text: December 28, 2000 - HIPAA Privacy Rule - Final Rule (
- link "PDF , opens in a new tab" [ref=e303] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/prdecember2000all8parts.pdf
- text: PDF
- generic [ref=e304]: ", opens in a new tab"
- text: )
- listitem [ref=e305]:
- text: November 3, 1999 - HIPAA Privacy Rule - Proposed Rule (
- link "PDF , opens in a new tab" [ref=e307] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/1999nprm.pdf
- text: PDF
- generic [ref=e308]: ", opens in a new tab"
- text: )
- heading "Other Privacy Rule Notices" [level=2] [ref=e309]
- list [ref=e310]:
- listitem [ref=e311]:
- text: March 20, 2003 - Notice of Addresses for Submission of HIPAA Health Information Privacy Complaints (
- link "PDF , opens in a new tab" [ref=e313] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/noticeaddresssubmission.pdf
- text: PDF
- generic [ref=e314]: ", opens in a new tab"
- text: )
- listitem [ref=e315]:
- text: March 11, 2003 -
- link "Notice of Address for Submission of Requests for Preemption Exception Determinations" [ref=e316] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/notice.txt
- text: (
- link "PDF , opens in a new tab" [ref=e318] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/notice.pdf
- text: PDF
- generic [ref=e319]: ", opens in a new tab"
- text: )
- listitem [ref=e320]:
- text: December 28, 2000 -
- link "Statement of Delegation of Authority to the Office for Civil Rights" [ref=e321] [cursor=pointer]:
- /url: /hipaa/for-professionals/privacy/delegation-of-authority/index.html
- text: (
- link "PDF , opens in a new tab" [ref=e323] [cursor=pointer]:
- /url: /sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/fedreg.pdf
- text: PDF
- generic [ref=e324]: ", opens in a new tab"
- text: )
- generic [ref=e326]:
- heading "Other Administrative Simplification Rules" [level=2] [ref=e327]
- list [ref=e329]:
- listitem [ref=e330]:
- link "Code Set Standards , opens in a new tab" [ref=e332] [cursor=pointer]:
- /url: https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification/code-sets
- text: Code Set Standards
- generic [ref=e333]: ", opens in a new tab"
- listitem [ref=e334]:
- link "Employer Identifier Standard , opens in a new tab" [ref=e336] [cursor=pointer]:
- /url: https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification/unique-identifiers/ein
- text: Employer Identifier Standard
- generic [ref=e337]: ", opens in a new tab"
- listitem [ref=e338]:
- link "National Provider Identifier Standard , opens in a new tab" [ref=e340] [cursor=pointer]:
- /url: https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/NationalProvIdentStand
- text: National Provider Identifier Standard
- generic [ref=e341]: ", opens in a new tab"
- listitem [ref=e342]:
- link "Security Rule" [ref=e343] [cursor=pointer]:
- /url: /hipaa/for-professionals/security/index.html
- listitem [ref=e344]:
- link "Enforcement Rule" [ref=e345] [cursor=pointer]:
- /url: /hipaa/for-professionals/special-topics/enforcement-rule/index.html
- listitem [ref=e346]:
- link "Breach Notification Rule" [ref=e347] [cursor=pointer]:
- /url: /hipaa/for-professionals/breach-notification/laws-regulations/index.html
- listitem [ref=e348]:
- link "Transactions , opens in a new tab" [ref=e350] [cursor=pointer]:
- /url: https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification/transactions
- text: Transactions
- generic [ref=e351]: ", opens in a new tab"
- paragraph [ref=e357]:
- link "Frequently Asked Questions for Professionals" [ref=e358] [cursor=pointer]:
- /url: https://www.hhs.gov/hipaa/for-professionals/faq/index.html
- text: "- Please see the HIPAA FAQs for additional guidance on health information privacy topics."
- generic [ref=e368]:
- text: Content last reviewed
- time [ref=e369]: September 27, 2024
- contentinfo [ref=e370]:
- link [ref=e371] [cursor=pointer]:
- /url: "#top"
- img [ref=e372]
- generic [ref=e374]: Back to top
- generic "Social media links and sign up" [ref=e375]:
- generic [ref=e377]:
- generic [ref=e378]:
- img "Secretary Robert F. Kennedy Jr." [ref=e380]
- generic [ref=e381]:
- heading "Follow @SecKennedy" [level=2] [ref=e382]
- generic [ref=e383]:
- link "Visit the Facebook account of Secretary Kennedy" [ref=e385] [cursor=pointer]:
- /url: https://www.facebook.com/SecKennedy
- img [ref=e386]
- link "Visit the X account of Secretary Kennedy" [ref=e389] [cursor=pointer]:
- /url: https://x.com/SecKennedy
- img [ref=e390]
- link "Visit the Instagram account of Secretary Kennedy" [ref=e393] [cursor=pointer]:
- /url: https://www.instagram.com/seckennedy/
- img [ref=e394]
- link "Visit the Truth Social account of Secretary Kennedy" [ref=e397] [cursor=pointer]:
- /url: https://truthsocial.com/@seckennedy
- img [ref=e398]
- link "Visit the LinkedIn account of Secretary Kennedy" [ref=e401] [cursor=pointer]:
- /url: https://www.linkedin.com/showcase/secretarykennedy/
- img [ref=e402]
- generic [ref=e404]:
- img "HHS icon" [ref=e406]
- generic [ref=e407]:
- heading "Follow @HHSGov" [level=2] [ref=e408]
- generic [ref=e409]:
- link "Visit the HHS Facebook account" [ref=e411] [cursor=pointer]:
- /url: https://www.facebook.com/HHS
- img [ref=e412]
- link "Visit the HHS X account" [ref=e415] [cursor=pointer]:
- /url: https://x.com/hhsgov
- img [ref=e416]
- link "Visit the HHS YouTube account" [ref=e419] [cursor=pointer]:
- /url: https://www.youtube.com/user/USGOVHHS?sub_confirmation=1
- img [ref=e420]
- link "Visit the HHS Instagram account" [ref=e423] [cursor=pointer]:
- /url: https://www.instagram.com/hhsgov/
- img [ref=e424]
- link "Visit the HHS LinkedIn account" [ref=e427] [cursor=pointer]:
- /url: https://www.linkedin.com/company/hhsgov
- img [ref=e428]
- generic [ref=e438]:
- heading "HHS Email updates" [level=3] [ref=e439]
- paragraph [ref=e440]: Receive email updates from HHS.
- paragraph [ref=e441]:
- link "Subscribe" [ref=e442] [cursor=pointer]:
- /url: https://cloud.connect.hhs.gov/subscriptioncenter
- contentinfo "Agency logo and contact information" [ref=e443]:
- generic [ref=e444]:
- link "HHS Logo" [ref=e448] [cursor=pointer]:
- /url: https://hhs.gov
- img "HHS Logo" [ref=e449]
- generic [ref=e450]:
- generic [ref=e452]:
- heading "HHS Headquarters" [level=3] [ref=e453]
- paragraph [ref=e457]:
- text: 200 Independence Avenue, S.W.
- text: Washington, D.C. 20201
- text: "Toll Free Call Center: 1-877-696-6775"
- navigation [ref=e459]:
- generic [ref=e460]:
- list [ref=e462]:
- listitem [ref=e463]:
- link "Contact HHS" [ref=e464] [cursor=pointer]:
- /url: /about/contact-us/index.html
- listitem [ref=e465]:
- link "Careers" [ref=e466] [cursor=pointer]:
- /url: https://www.hhs.gov/careers/
- listitem [ref=e467]:
- link "HHS FAQs" [ref=e468] [cursor=pointer]:
- /url: /answers/index.html
- listitem [ref=e469]:
- link "Nondiscrimination Notice" [ref=e470] [cursor=pointer]:
- /url: /civil-rights/for-individuals/nondiscrimination/index.html
- list [ref=e472]:
- listitem [ref=e473]:
- link "Press Room" [ref=e474] [cursor=pointer]:
- /url: /press-room/index.html
- listitem [ref=e475]:
- link "HHS Archive" [ref=e476] [cursor=pointer]:
- /url: /about/archive/index.html
- listitem [ref=e477]:
- link "Accessibility Statement" [ref=e478] [cursor=pointer]:
- /url: /web/section-508/hhs-digital-accessibility-statement/index.html
- list [ref=e480]:
- listitem [ref=e481]:
- link "Budget/Performance" [ref=e482] [cursor=pointer]:
- /url: /about/budget/index.html
- listitem [ref=e483]:
- link "Inspector General" [ref=e484] [cursor=pointer]:
- /url: https://oig.hhs.gov/
- listitem [ref=e485]:
- link "Web Site Disclaimers" [ref=e486] [cursor=pointer]:
- /url: /web/policies-and-standards/hhs-web-policies/disclaimer/index.html
- listitem [ref=e487]:
- link "EEO/No Fear Act" [ref=e488] [cursor=pointer]:
- /url: /about/agencies/asa/eeo/no-fear-act/index.html
- list [ref=e490]:
- listitem [ref=e491]:
- link "FOIA" [ref=e492] [cursor=pointer]:
- /url: /foia/index.html
- listitem [ref=e493]:
- link "The White House" [ref=e494] [cursor=pointer]:
- /url: https://www.whitehouse.gov/
- listitem [ref=e495]:
- link "USA.gov" [ref=e496] [cursor=pointer]:
- /url: https://www.usa.gov/
- listitem [ref=e497]:
- link "Vulnerability Disclosure Policy" [ref=e498] [cursor=pointer]:
- /url: /vulnerability-disclosure-policy/index.html
```

## Security Rule Page Snapshot

```text
Page Title: The Security Rule | HHS.gov
URL: https://www.hhs.gov/hipaa/for-professionals/security/index.html
Snapshot:
- generic [active] [ref=e1]:
- link "Skip to main content" [ref=e2] [cursor=pointer]:
- /url: "#main"
- generic [ref=e4]:
- region "Official government website" [ref=e5]:
- generic [ref=e8]:
- img "U.S. flag" [ref=e10]
- paragraph [ref=e12]: An official website of the United States government
- button "Here’s how you know" [ref=e13] [cursor=pointer]
- generic [ref=e19]:
- img "Freedom 250 banner logo" [ref=e20]
- link "Join HHS in Celebrating Freedom 250" [ref=e21] [cursor=pointer]:
- /url: /freedom250/index.html
- img [ref=e22]
- banner [ref=e24]:
- generic [ref=e25]:
- link "Home" [ref=e28] [cursor=pointer]:
- /url: /
- img [ref=e29]
- button "Menu" [ref=e115]
- generic [ref=e118]:
- navigation "breadcrumb-label-11786852735" [ref=e120]:
- generic [ref=e122]:
- generic [ref=e123]: Breadcrumb
- list [ref=e124]:
- listitem [ref=e125]:
- link "HHS" [ref=e126] [cursor=pointer]:
- /url: /
- listitem [ref=e127]:
- link "HIPAA Home" [ref=e128] [cursor=pointer]:
- /url: /hipaa/index.html
- listitem [ref=e129]:
- link "For Professionals" [ref=e130] [cursor=pointer]:
- /url: /hipaa/for-professionals/index.html
- listitem [ref=e131]: The Security Rule
- list [ref=e135]:
- listitem [ref=e136]:
- checkbox "Adjust Text Size" [ref=e137] [cursor=pointer]:
- img [ref=e138]
- listitem [ref=e139]:
- link "Print" [ref=e140] [cursor=pointer]:
- /url: "#"
- img [ref=e141]
- listitem [ref=e143]:
- button "Page sharing options" [ref=e144] [cursor=pointer]:
- img [ref=e145]
- generic [ref=e147]: Page sharing options
- main [ref=e148]:
- generic [ref=e152]:
- complementary [ref=e153]:
- button "Navigate to:" [ref=e156] [cursor=pointer]
- generic [ref=e157]:
- generic [ref=e160]:
- heading "The Security Rule" [level=1] [ref=e161]
- article [ref=e162]:
- generic [ref=e163]:
- generic [ref=e167]:
- paragraph [ref=e168]: The HIPAA Security Rule establishes national standards to protect individuals' electronic protected health information that is created, received, used, or maintained by a covered entity or its business associate. The Security Rule requires implementation of appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information.
- paragraph [ref=e169]:
- text: The Security Rule is located at 45 CFR
- link "Part 160 , links to an external website" [ref=e170] [cursor=pointer]:
- /url: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160?toc=1
- text: Part 160
- generic [ref=e172]: ", links to an external website"
- text: and Subparts A and C of
- link "Part 164 , links to an external website" [ref=e173] [cursor=pointer]:
- /url: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
- text: Part 164
- generic [ref=e175]: ", links to an external website"
- text: .
- paragraph [ref=e176]:
- link "View the combined regulation text" [ref=e177] [cursor=pointer]:
- /url: https://www.hhs.gov/ocr/privacy/hipaa/administrative/combined/index.html?language=es
- text: of all HIPAA Administrative Simplification Regulations found at 45 CFR 160, 162, and 164.
- generic [ref=e181]:
- heading "Security Rule History" [level=2] [ref=e182]
- generic [ref=e184]:
- generic [ref=e186]:
- heading "January 6, 2025" [level=3] [ref=e187]
- paragraph [ref=e188]:
- link "HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information – Proposed Rule , links to an external website" [ref=e189] [cursor=pointer]:
- /url: https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
- text: HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information – Proposed Rule
- generic [ref=e191]: ", links to an external website"
- separator [ref=e192]
- generic [ref=e194]:
- heading "January 25, 2013" [level=3] [ref=e195]
- paragraph [ref=e196]:
- link "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications – Final Rule , links to an external website , opens in a new tab" [ref=e198] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2013-01-25/pdf/2013-01073.pdf
- text: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications – Final Rule
- generic [ref=e200]: ", links to an external website"
- generic [ref=e201]: ", opens in a new tab"
- text: (The “Omnibus HIPAA Final Rule”)
- separator [ref=e202]
- generic [ref=e204]:
- heading "July 14, 2010" [level=3] [ref=e205]
- paragraph [ref=e206]:
- link "Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act – Proposed Rule , links to an external website , opens in a new tab" [ref=e208] [cursor=pointer]:
- /url: https://www.govinfo.gov/content/pkg/FR-2010-07-14/pdf/2010-16718.pdf
- text: Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act – Proposed Rule
- generic [ref=e210]: ", links to an external website"
- generic [ref=e211]: ", opens in a new tab"
- separator [ref=e212]
- generic [ref=e214]:
- heading "August 4, 2009" [level=3] [ref=e215]
- paragraph [ref=e216]:
- link "Federal Register notice of the Delegation of Authority to OCR (74 FR 38630)" [ref=e217] [cursor=pointer]:
- /url: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/srdelegation.pdf?language=es
- separator [ref=e218]
- generic [ref=e220]:
- heading "February 20, 2003" [level=3] [ref=e221]
- paragraph [ref=e222]:
- link "Security Standards – Final Rule" [ref=e223] [cursor=pointer]:
- /url: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/securityrulepdf.pdf?language=es
- separator [ref=e224]
- generic [ref=e226]:
- heading "August 12, 1998" [level=3] [ref=e227]
- paragraph [ref=e228]:
- link "Security and Electronic Signature Standards - Proposed Rule" [ref=e229] [cursor=pointer]:
- /url: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/srnprm.pdf?language=es
- separator [ref=e230]
- generic [ref=e234]:
- heading "HHS Security Risk Assessment Tool" [level=2] [ref=e235]
- paragraph [ref=e236]:
- text: The Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) and the HHS Office for Civil Rights (OCR) have jointly launched a
- link "Security Risk Assessment Tool for regulated entities" [ref=e237] [cursor=pointer]:
- /url: https://healthit.gov/privacy-security/security-risk-assessment-tool/
- text: . The tool's features make it useful in assisting small and medium-sized health care practices and business associates as they perform a risk assessment.
- heading "OCR and NIST HIPAA Security Rule Conference" [level=2] [ref=e238]
- paragraph [ref=e239]:
- strong [ref=e240]: "Safeguarding Health Information: Building Assurance Through HIPAA Security"
- paragraph [ref=e241]:
- text: View the presentations from the
- link "OCR and NIST HIPAA Security Rule Conference , links to an external website" [ref=e242] [cursor=pointer]:
- /url: https://www.nist.gov/news-events/events/2024/10/safeguarding-health-information-building-assurance-through-hipaa-security
- text: OCR and NIST HIPAA Security Rule Conference
- generic [ref=e244]: ", links to an external website"
- text: held October 23-24, 2024.
- heading "Security Rule Guidance" [level=2] [ref=e245]
- paragraph [ref=e246]:
- text: See the
- link "Security Rule Guidance" [ref=e247] [cursor=pointer]:
- /url: /hipaa/for-professionals/security/guidance/index.html?language=es
- text: and
- link "Cyber Security Guidance" [ref=e248] [cursor=pointer]:
- /url: /hipaa/for-professionals/security/guidance/cybersecurity/index.html
- text: webpages for guidance
- generic [ref=e258]:
- text: Content last reviewed
- time [ref=e259]: March 19, 2026
- contentinfo [ref=e260]:
- link [ref=e261] [cursor=pointer]:
- /url: "#top"
- img [ref=e262]
- generic [ref=e264]: Back to top
- generic "Social media links and sign up" [ref=e265]:
- generic [ref=e267]:
- generic [ref=e268]:
- img "Secretary Robert F. Kennedy Jr." [ref=e270]
- generic [ref=e271]:
- heading "Follow @SecKennedy" [level=2] [ref=e272]
- generic [ref=e273]:
- link "Visit the Facebook account of Secretary Kennedy" [ref=e275] [cursor=pointer]:
- /url: https://www.facebook.com/SecKennedy
- img [ref=e276]
- link "Visit the X account of Secretary Kennedy" [ref=e279] [cursor=pointer]:
- /url: https://x.com/SecKennedy
- img [ref=e280]
- link "Visit the Instagram account of Secretary Kennedy" [ref=e283] [cursor=pointer]:
- /url: https://www.instagram.com/seckennedy/
- img [ref=e284]
- link "Visit the Truth Social account of Secretary Kennedy" [ref=e287] [cursor=pointer]:
- /url: https://truthsocial.com/@seckennedy
- img [ref=e288]
- link "Visit the LinkedIn account of Secretary Kennedy" [ref=e291] [cursor=pointer]:
- /url: https://www.linkedin.com/showcase/secretarykennedy/
- img [ref=e292]
- generic [ref=e294]:
- img "HHS icon" [ref=e296]
- generic [ref=e297]:
- heading "Follow @HHSGov" [level=2] [ref=e298]
- generic [ref=e299]:
- link "Visit the HHS Facebook account" [ref=e301] [cursor=pointer]:
- /url: https://www.facebook.com/HHS
- img [ref=e302]
- link "Visit the HHS X account" [ref=e305] [cursor=pointer]:
- /url: https://x.com/hhsgov
- img [ref=e306]
- link "Visit the HHS YouTube account" [ref=e309] [cursor=pointer]:
- /url: https://www.youtube.com/user/USGOVHHS?sub_confirmation=1
- img [ref=e310]
- link "Visit the HHS Instagram account" [ref=e313] [cursor=pointer]:
- /url: https://www.instagram.com/hhsgov/
- img [ref=e314]
- link "Visit the HHS LinkedIn account" [ref=e317] [cursor=pointer]:
- /url: https://www.linkedin.com/company/hhsgov
- img [ref=e318]
- generic [ref=e328]:
- heading "HHS Email updates" [level=3] [ref=e329]
- paragraph [ref=e330]: Receive email updates from HHS.
- paragraph [ref=e331]:
- link "Subscribe" [ref=e332] [cursor=pointer]:
- /url: https://cloud.connect.hhs.gov/subscriptioncenter
- contentinfo "Agency logo and contact information" [ref=e333]:
- generic [ref=e334]:
- link "HHS Logo" [ref=e338] [cursor=pointer]:
- /url: https://hhs.gov
- img "HHS Logo" [ref=e339]
- generic [ref=e340]:
- generic [ref=e342]:
- heading "HHS Headquarters" [level=3] [ref=e343]
- paragraph [ref=e347]:
- text: 200 Independence Avenue, S.W.
- text: Washington, D.C. 20201
- text: "Toll Free Call Center: 1-877-696-6775"
- navigation [ref=e349]:
- generic [ref=e350]:
- list [ref=e352]:
- listitem [ref=e353]:
- link "Contact HHS" [ref=e354] [cursor=pointer]:
- /url: /about/contact-us/index.html
- listitem [ref=e355]:
- link "Careers" [ref=e356] [cursor=pointer]:
- /url: https://www.hhs.gov/careers/
- listitem [ref=e357]:
- link "HHS FAQs" [ref=e358] [cursor=pointer]:
- /url: /answers/index.html
- listitem [ref=e359]:
- link "Nondiscrimination Notice" [ref=e360] [cursor=pointer]:
- /url: /civil-rights/for-individuals/nondiscrimination/index.html
- list [ref=e362]:
- listitem [ref=e363]:
- link "Press Room" [ref=e364] [cursor=pointer]:
- /url: /press-room/index.html
- listitem [ref=e365]:
- link "HHS Archive" [ref=e366] [cursor=pointer]:
- /url: /about/archive/index.html
- listitem [ref=e367]:
- link "Accessibility Statement" [ref=e368] [cursor=pointer]:
- /url: /web/section-508/hhs-digital-accessibility-statement/index.html
- list [ref=e370]:
- listitem [ref=e371]:
- link "Budget/Performance" [ref=e372] [cursor=pointer]:
- /url: /about/budget/index.html
- listitem [ref=e373]:
- link "Inspector General" [ref=e374] [cursor=pointer]:
- /url: https://oig.hhs.gov/
- listitem [ref=e375]:
- link "Web Site Disclaimers" [ref=e376] [cursor=pointer]:
- /url: /web/policies-and-standards/hhs-web-policies/disclaimer/index.html
- listitem [ref=e377]:
- link "EEO/No Fear Act" [ref=e378] [cursor=pointer]:
- /url: /about/agencies/asa/eeo/no-fear-act/index.html
- list [ref=e380]:
- listitem [ref=e381]:
- link "FOIA" [ref=e382] [cursor=pointer]:
- /url: /foia/index.html
- listitem [ref=e383]:
- link "The White House" [ref=e384] [cursor=pointer]:
- /url: https://www.whitehouse.gov/
- listitem [ref=e385]:
- link "USA.gov" [ref=e386] [cursor=pointer]:
- /url: https://www.usa.gov/
- listitem [ref=e387]:
- link "Vulnerability Disclosure Policy" [ref=e388] [cursor=pointer]:
- /url: /vulnerability-disclosure-policy/index.html
```

## Breach Notification Rule Page Snapshot

```text
Page Title: Breach Notification Rule | HHS.gov
URL: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
Snapshot:
- generic [active] [ref=e1]:
- link "Skip to main content" [ref=e2] [cursor=pointer]:
- /url: "#main"
- generic [ref=e4]:
- region "Official government website" [ref=e5]:
- generic [ref=e8]:
- img "U.S. flag" [ref=e10]
- paragraph [ref=e12]: An official website of the United States government
- button "Here’s how you know" [ref=e13] [cursor=pointer]
- generic [ref=e19]:
- img "Freedom 250 banner logo" [ref=e20]
- link "Join HHS in Celebrating Freedom 250" [ref=e21] [cursor=pointer]:
- /url: /freedom250/index.html
- img [ref=e22]
- banner [ref=e24]:
- generic [ref=e25]:
- link "Home" [ref=e28] [cursor=pointer]:
- /url: /
- img [ref=e29]
- button "Menu" [ref=e115]
- generic [ref=e118]:
- navigation "breadcrumb-label-11751584064" [ref=e120]:
- generic [ref=e122]:
- generic [ref=e123]: Breadcrumb
- list [ref=e124]:
- listitem [ref=e125]:
- link "HHS" [ref=e126] [cursor=pointer]:
- /url: /
- listitem [ref=e127]:
- link "HIPAA Home" [ref=e128] [cursor=pointer]:
- /url: /hipaa/index.html
- listitem [ref=e129]:
- link "For Professionals" [ref=e130] [cursor=pointer]:
- /url: /hipaa/for-professionals/index.html
- listitem [ref=e131]: Breach Notification Rule
- list [ref=e135]:
- listitem [ref=e136]:
- checkbox "Adjust Text Size" [ref=e137] [cursor=pointer]:
- img [ref=e138]
- listitem [ref=e139]:
- link "Print" [ref=e140] [cursor=pointer]:
- /url: "#"
- img [ref=e141]
- listitem [ref=e143]:
- button "Page sharing options" [ref=e144] [cursor=pointer]:
- img [ref=e145]
- generic [ref=e147]: Page sharing options
- main [ref=e148]:
- generic [ref=e152]:
- complementary [ref=e153]:
- button "Navigate to:" [ref=e156] [cursor=pointer]
- generic [ref=e157]:
- generic [ref=e160]:
- heading "Breach Notification Rule" [level=1] [ref=e161]
- article [ref=e162]:
- generic [ref=e167]:
- paragraph [ref=e168]:
- text: The HIPAA Breach Notification Rule, 45 CFR §§ 164.400-414, requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information. Similar breach notification provisions implemented and enforced by the
- link "Federal Trade Commission (FTC) , links to an external website" [ref=e169] [cursor=pointer]:
- /url: http://business.ftc.gov/privacy-and-security/health-privacy/health-breach-notification-rule
- text: Federal Trade Commission (FTC)
- generic [ref=e171]: ", links to an external website"
- text: ", apply to vendors of personal health records and their third party service providers, pursuant to section 13407 of the HITECH Act."
- heading "Definition of Breach" [level=2] [ref=e172]
- paragraph [ref=e173]: "A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:"
- list [ref=e174]:
- listitem [ref=e175]: The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;
- listitem [ref=e176]: The unauthorized person who used the protected health information or to whom the disclosure was made;
- listitem [ref=e177]: Whether the protected health information was actually acquired or viewed; and
- listitem [ref=e178]: The extent to which the risk to the protected health information has been mitigated.
- paragraph [ref=e179]: Covered entities and business associates, where applicable, have discretion to provide the required breach notifications following an impermissible use or disclosure without performing a risk assessment to determine the probability that the protected health information has been compromised.
- paragraph [ref=e180]: There are three exceptions to the definition of “breach.” The first exception applies to the unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or business associate, if such acquisition, access, or use was made in good faith and within the scope of authority. The second exception applies to the inadvertent disclosure of protected health information by a person authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the covered entity or business associate, or organized health care arrangement in which the covered entity participates. In both cases, the information cannot be further used or disclosed in a manner not permitted by the Privacy Rule. The final exception applies if the covered entity or business associate has a good faith belief that the unauthorized person to whom the impermissible disclosure was made, would not have been able to retain the information.
- heading "Unsecured Protected Health Information and Guidance" [level=2] [ref=e181]
- paragraph [ref=e182]: Covered entities and business associates must only provide the required notifications if the breach involved unsecured protected health information. Unsecured protected health information is protected health information that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in guidance.
- paragraph [ref=e183]: This guidance was first issued in April 2009 with a request for public comment. The guidance was reissued after consideration of public comment received and specifies encryption and destruction as the technologies and methodologies for rendering protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Additionally, the guidance also applies to unsecured personal health record identifiable health information under the FTC regulations. Covered entities and business associates, as well as entities regulated by the FTC regulations, that secure information as specified by the guidance are relieved from providing notifications following the breach of such information.
- paragraph [ref=e184]:
- link "View the Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals." [ref=e185] [cursor=pointer]:
- /url: /hipaa/for-professionals/breach-notification/guidance/index.html
- heading "Breach Notification Requirements" [level=2] [ref=e186]
- paragraph [ref=e187]: Following a breach of unsecured protected health information, covered entities must provide notification of the breach to affected individuals, the Secretary, and, in certain circumstances, to the media. In addition, business associates must notify covered entities if a breach occurs at or by the business associate.
- heading "Individual Notice" [level=3] [ref=e188]
- paragraph [ref=e189]: Covered entities must notify affected individuals following the discovery of a breach of unsecured protected health information. Covered entities must provide this individual notice in written form by first-class mail, or alternatively, by e-mail if the affected individual has agreed to receive such notices electronically. If the covered entity has insufficient or out-of-date contact information for 10 or more individuals, the covered entity must provide substitute individual notice by either posting the notice on the home page of its web site for at least 90 days or by providing the notice in major print or broadcast media where the affected individuals likely reside. The covered entity must include a toll-free phone number that remains active for at least 90 days where individuals can learn if their information was involved in the breach. If the covered entity has insufficient or out-of-date contact information for fewer than 10 individuals, the covered entity may provide substitute notice by an alternative form of written notice, by telephone, or other means.
- paragraph [ref=e190]: These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include, to the extent possible, a brief description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as contact information for the covered entity (or business associate, as applicable).
- paragraph [ref=e191]: With respect to a breach at or by a business associate, while the covered entity is ultimately responsible for ensuring individuals are notified, the covered entity may delegate the responsibility of providing individual notices to the business associate. Covered entities and business associates should consider which entity is in the best position to provide notice to the individual, which may depend on various circumstances, such as the functions the business associate performs on behalf of the covered entity and which entity has the relationship with the individual.
- heading "Media Notice" [level=3] [ref=e192]
- paragraph [ref=e193]: Covered entities that experience a breach affecting more than 500 residents of a State or jurisdiction are, in addition to notifying the affected individuals, required to provide notice to prominent media outlets serving the State or jurisdiction. Covered entities will likely provide this notification in the form of a press release to appropriate media outlets serving the affected area. Like individual notice, this media notification must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include the same information required for the individual notice.
- heading "Notice to the Secretary" [level=3] [ref=e194]
- paragraph [ref=e195]:
- text: In addition to notifying affected individuals and the media (where appropriate), covered entities must notify the Secretary of breaches of unsecured protected health information. Covered entities will notify the Secretary by visiting the HHS web site and
- link "filling out and electronically submitting a breach report form" [ref=e196] [cursor=pointer]:
- /url: /hipaa/for-professionals/breach-notification/breach-reporting/index.html
- text: . If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach. If, however, a breach affects fewer than 500 individuals, the covered entity may notify the Secretary of such breaches on an annual basis. Reports of breaches affecting fewer than 500 individuals are due to the Secretary no later than 60 days after the end of the calendar year in which the breaches are discovered.
- heading "Notification by a Business Associate" [level=2] [ref=e197]
- paragraph [ref=e198]: If a breach of unsecured protected health information occurs at or by a business associate, the business associate must notify the covered entity following the discovery of the breach. A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach. To the extent possible, the business associate should provide the covered entity with the identification of each individual affected by the breach as well as any other available information required to be provided by the covered entity in its notification to affected individuals.
- heading "Administrative Requirements and Burden of Proof" [level=2] [ref=e199]
- paragraph [ref=e200]: "Covered entities and business associates, as applicable, have the burden of demonstrating that all required notifications have been provided or that a use or disclosure of unsecured protected health information did not constitute a breach. Thus, with respect to an impermissible use or disclosure, a covered entity (or business associate) should maintain documentation that all required notifications were made, or, alternatively, documentation to demonstrate that notification was not required: (1) its risk assessment demonstrating a low probability that the protected health information has been compromised by the impermissible use or disclosure; or (2) the application of any other exceptions to the definition of “breach.”"
- paragraph [ref=e201]: Covered entities are also required to comply with certain administrative requirements with respect to breach notification. For example, covered entities must have in place written policies and procedures regarding breach notification, must train employees on these policies and procedures, and must develop and apply appropriate sanctions against workforce members who do not comply with these policies and procedures.
- heading "Instructions for Covered Entities to Submit Breach Notifications to the Secretary" [level=2] [ref=e202]
- paragraph [ref=e203]:
- link "Submit a Breach Notification to the Secretary" [ref=e204] [cursor=pointer]:
- /url: /hipaa/for-professionals/breach-notification/breach-reporting/index.html
- heading "View Breaches Affecting 500 or More Individuals" [level=2] [ref=e205]
- paragraph [ref=e207]:
- text: Breaches of Unsecured Protected Health Information affecting 500 or more individuals.
- link "View a list of these breaches." [ref=e208] [cursor=pointer]:
- /url: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- paragraph [ref=e209]
- generic [ref=e219]:
- text: Content last reviewed
- time [ref=e220]: July 26, 2013
- contentinfo [ref=e221]:
- link [ref=e222] [cursor=pointer]:
- /url: "#top"
- img [ref=e223]
- generic [ref=e225]: Back to top
- generic "Social media links and sign up" [ref=e226]:
- generic [ref=e228]:
- generic [ref=e229]:
- img "Secretary Robert F. Kennedy Jr." [ref=e231]
- generic [ref=e232]:
- heading "Follow @SecKennedy" [level=2] [ref=e233]
- generic [ref=e234]:
- link "Visit the Facebook account of Secretary Kennedy" [ref=e236] [cursor=pointer]:
- /url: https://www.facebook.com/SecKennedy
- img [ref=e237]
- link "Visit the X account of Secretary Kennedy" [ref=e240] [cursor=pointer]:
- /url: https://x.com/SecKennedy
- img [ref=e241]
- link "Visit the Instagram account of Secretary Kennedy" [ref=e244] [cursor=pointer]:
- /url: https://www.instagram.com/seckennedy/
- img [ref=e245]
- link "Visit the Truth Social account of Secretary Kennedy" [ref=e248] [cursor=pointer]:
- /url: https://truthsocial.com/@seckennedy
- img [ref=e249]
- link "Visit the LinkedIn account of Secretary Kennedy" [ref=e252] [cursor=pointer]:
- /url: https://www.linkedin.com/showcase/secretarykennedy/
- img [ref=e253]
- generic [ref=e255]:
- img "HHS icon" [ref=e257]
- generic [ref=e258]:
- heading "Follow @HHSGov" [level=2] [ref=e259]
- generic [ref=e260]:
- link "Visit the HHS Facebook account" [ref=e262] [cursor=pointer]:
- /url: https://www.facebook.com/HHS
- img [ref=e263]
- link "Visit the HHS X account" [ref=e266] [cursor=pointer]:
- /url: https://x.com/hhsgov
- img [ref=e267]
- link "Visit the HHS YouTube account" [ref=e270] [cursor=pointer]:
- /url: https://www.youtube.com/user/USGOVHHS?sub_confirmation=1
- img [ref=e271]
- link "Visit the HHS Instagram account" [ref=e274] [cursor=pointer]:
- /url: https://www.instagram.com/hhsgov/
- img [ref=e275]
- link "Visit the HHS LinkedIn account" [ref=e278] [cursor=pointer]:
- /url: https://www.linkedin.com/company/hhsgov
- img [ref=e279]
- generic [ref=e289]:
- heading "HHS Email updates" [level=3] [ref=e290]
- paragraph [ref=e291]: Receive email updates from HHS.
- paragraph [ref=e292]:
- link "Subscribe" [ref=e293] [cursor=pointer]:
- /url: https://cloud.connect.hhs.gov/subscriptioncenter
- contentinfo "Agency logo and contact information" [ref=e294]:
- generic [ref=e295]:
- link "HHS Logo" [ref=e299] [cursor=pointer]:
- /url: https://hhs.gov
- img "HHS Logo" [ref=e300]
- generic [ref=e301]:
- generic [ref=e303]:
- heading "HHS Headquarters" [level=3] [ref=e304]
- paragraph [ref=e308]:
- text: 200 Independence Avenue, S.W.
- text: Washington, D.C. 20201
- text: "Toll Free Call Center: 1-877-696-6775"
- navigation [ref=e310]:
- generic [ref=e311]:
- list [ref=e313]:
- listitem [ref=e314]:
- link "Contact HHS" [ref=e315] [cursor=pointer]:
- /url: /about/contact-us/index.html
- listitem [ref=e316]:
- link "Careers" [ref=e317] [cursor=pointer]:
- /url: https://www.hhs.gov/careers/
- listitem [ref=e318]:
- link "HHS FAQs" [ref=e319] [cursor=pointer]:
- /url: /answers/index.html
- listitem [ref=e320]:
- link "Nondiscrimination Notice" [ref=e321] [cursor=pointer]:
- /url: /civil-rights/for-individuals/nondiscrimination/index.html
- list [ref=e323]:
- listitem [ref=e324]:
- link "Press Room" [ref=e325] [cursor=pointer]:
- /url: /press-room/index.html
- listitem [ref=e326]:
- link "HHS Archive" [ref=e327] [cursor=pointer]:
- /url: /about/archive/index.html
- listitem [ref=e328]:
- link "Accessibility Statement" [ref=e329] [cursor=pointer]:
- /url: /web/section-508/hhs-digital-accessibility-statement/index.html
- list [ref=e331]:
- listitem [ref=e332]:
- link "Budget/Performance" [ref=e333] [cursor=pointer]:
- /url: /about/budget/index.html
- listitem [ref=e334]:
- link "Inspector General" [ref=e335] [cursor=pointer]:
- /url: https://oig.hhs.gov/
- listitem [ref=e336]:
- link "Web Site Disclaimers" [ref=e337] [cursor=pointer]:
- /url: /web/policies-and-standards/hhs-web-policies/disclaimer/index.html
- listitem [ref=e338]:
- link "EEO/No Fear Act" [ref=e339] [cursor=pointer]:
- /url: /about/agencies/asa/eeo/no-fear-act/index.html
- list [ref=e341]:
- listitem [ref=e342]:
- link "FOIA" [ref=e343] [cursor=pointer]:
- /url: /foia/index.html
- listitem [ref=e344]:
- link "The White House" [ref=e345] [cursor=pointer]:
- /url: https://www.whitehouse.gov/
- listitem [ref=e346]:
- link "USA.gov" [ref=e347] [cursor=pointer]:
- /url: https://www.usa.gov/
- listitem [ref=e348]:
- link "Vulnerability Disclosure Policy" [ref=e349] [cursor=pointer]:
- /url: /vulnerability-disclosure-policy/index.html
```