Breach Notification Rule Definition

The HIPAA Breach Notification Rule is a federal regulation issued by the U.S. Department of Health and Human Services (HHS) that requires covered entities and their business associates to provide notification following a breach of unsecured protected health information (PHI). The Rule requires prompt notification to affected individuals, HHS, and, in some cases, the media. Covered entities and their business associates must have in place procedures and policies for providing the required notifications. The Rule applies to all PHI that is protected under the HIPAA Privacy Rule and maintained in any form, including paper, electronic, or oral. The Rule requires notification to HHS and the affected individuals without unreasonable delay and in no case later than 60 calendar days after the breach is discovered. Additionally, the Rule requires covered entities to maintain and provide documentation of their breach notification activities.