42 U.S.C. § 17932 — Notification in the case of breach

(a) In general. A covered entity^* that accesses, keeps, changes, records, stores, destroys, holds, uses, or discloses unsecured protected health information^* (defined in subsection (h)(1)) must, if it discovers a breach^* of that information, notify every individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, or disclosed because of the breach.

(b) Notification of covered entity by business associate^*. A business associate that accesses, keeps, changes, records, stores, destroys, holds, uses, or discloses unsecured protected health information must, after discovering a breach, notify the covered entity. That notice must name every individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, or disclosed in the breach.

(c) Breaches treated as discovered. A breach counts as discovered on the first day the covered entity or business associate (or any employee, officer, or other agent of theirs, other than the person who committed the breach) knew about it, or reasonably should have known about it.

(d) Timeliness of notification. (1) In general. Subject to subsection (g), every notification under this section must happen without unreasonable delay, and no later than 60 calendar days after the covered entity (or business associate, for notice under subsection (b)) discovers the breach. (2) Burden of proof. The covered entity (or business associate) must prove that it gave every notification as required, including evidence justifying any delay.

(e) Methods of notice. (1) Individual notice. Notice to an individual about a breach must be given promptly, in this form: (A) written notice by first-class mail to the individual (or next of kin, if the individual has died) at their last known address, or by email if the individual asked for that; the notice can go out in more than one mailing as information becomes available. (B) If contact information is missing or outdated so that direct written or email notice isn't possible, a substitute notice is required, and if 10 or more individuals lack good contact information, that substitute must include a prominent posting on the covered entity's website home page for a period the Secretary^* sets, or notice in major print or broadcast media in the areas where the affected individuals likely live; that media or web notice must include a toll-free number so people can check if their information was part of the breach. (C) If the covered entity thinks urgent action is needed because of possible immediate misuse of the information, it may, in addition to the notice in (A), contact individuals by phone or other means, as appropriate. (2) Media notice. If a breach affects more than 500 residents of a state^* or jurisdiction, the covered entity must also notify major media outlets serving that state or jurisdiction. (3) Notice to Secretary. Covered entities must notify the Secretary about breaches of unsecured protected health information. If a breach affects 500 or more individuals, that notice must be immediate. If it affects fewer than 500, the covered entity may instead keep a log of such breaches and submit that log to the Secretary once a year. (4) Posting on HHS public website. The Secretary must publish, on the Department of Health and Human Services website, a public list naming every covered entity involved in a breach affecting more than 500 individuals.

(f) Content of notification. However notice is given, it must include, as much as possible: (1) a brief description of what happened, including when the breach occurred and when it was discovered, if known; (2) a description of what kinds of unsecured protected health information were involved (such as full name, Social Security^* number, birth date, home address, account number, or disability code); (3) steps individuals should take to protect themselves from harm; (4) a brief description of what the covered entity is doing to investigate, limit losses, and prevent further breaches; and (5) contact information for questions, including a toll-free phone number, email address, website, or mailing address.

(g) Delay of notification authorized for law enforcement purposes. If a law enforcement official decides that notice, or a public posting, required under this section would interfere with a criminal investigation or harm national security, that notice or posting must be delayed the same way section 164.528(a)(2) of title 45, Code of Federal Regulations, allows for a delayed disclosure^*.

(h) Unsecured protected health information. (1) Definition. (A) In general. Subject to (B), "unsecured protected health information" means protected health information that isn't secured using a technology or method the Secretary specifies in guidance issued under paragraph (2). (B) Exception if timely guidance not issued. If the Secretary hasn't issued that guidance by the deadline in paragraph (2), "unsecured protected health information" instead means protected health information not secured by a technology standard, developed or endorsed by an ANSI-accredited standards organization, that makes the information unusable, unreadable, or undecipherable to unauthorized people. (2) Guidance. For purposes of paragraph (1) and section 17937(f)(3), within 60 days after February 17, 2009, the Secretary must, after consulting stakeholders, issue and annually update guidance specifying the technologies and methods that make protected health information unusable, unreadable, or undecipherable to unauthorized people, including standards developed under section 300jj-12(b)(2)(B)(vi) of this title.

(i) Report to Congress on breaches. (1) In general. Within 12 months after February 17, 2009, and every year after, the Secretary must send the Committee on Finance and the Committee on Health, Education, Labor, and Pensions of the Senate, and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives, a report on breaches for which the Secretary got notice under subsection (e)(3). (2) Information. That report must include (A) how many such breaches happened and what kind they were, and (B) what actions were taken in response.

(j) Regulations; effective date. The Secretary must issue interim final regulations to carry out this section within 180 days after February 17, 2009. This section applies to breaches discovered on or after 30 days after those regulations are published.