The HIPAA breach notification rule gives a covered entity 60 days from discovering a breach to notify affected individuals, and that's the ceiling. The rule's first requirement is notice "without unreasonable delay," so a team that has everything it needs on day 10 and waits until day 59 can still be late.
For a telehealth company, the harder questions come before any letter goes out. Was the incident a breach at all? Did it happen at a vendor? How many patients, in which states? The answers decide who has to be told and by when, and they sit inside the broader work of HIPAA compliance in telehealth.
Is It a Breach at All?
The Breach Notification Rule page at HHS starts from a presumption. An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate can show a low probability that the information was compromised. That showing comes from a risk assessment of at least four factors:
- The nature and extent of the protected health information involved
- The unauthorized person who used the information or received it
- Whether the information was actually acquired or viewed
- The extent to which the risk has been mitigated
The organization bears the burden of proof, so it should document the assessment and its conclusion in writing. Getting the first factor right depends on knowing what counts as PHI, since a leaked marketing list and a leaked intake record are very different incidents.
Three situations fall outside the definition of a breach. One is an unintentional acquisition, access, or use by a workforce member acting in good faith and within the scope of their authority. Another is an inadvertent disclosure between people authorized to access the information. The third applies when the organization has a good-faith belief that the recipient could not have retained the information.
Encryption also matters here. The rule applies to unsecured protected health information, meaning information that has not been rendered unusable, unreadable, or indecipherable to unauthorized people. HHS guidance names encryption and destruction as methods that secure it, and it does not require notification for information secured that way.
When the Breach Starts at a Vendor
A telehealth brand's patient data rarely sits in one system. The care platform, a HIPAA-compliant CRM, the email service, and the cloud host can each hold it, and each one handling it on the brand's behalf is a business associate. A breach at any of them still has to reach the brand.
A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 days after discovery. To the extent possible, it must identify each individual affected. That identification is what the brand's own notices are built on, because a brand can't write to patients it can't name. The notice terms in each business associate agreement are worth reading before an incident happens.
Incident Records on the Bask Platform
How quickly a team can work through the four-factor questions depends on where its patient data lives and what its systems recorded. On Bask, intake, video and chat visits, the EMR and e-prescribing tools, pharmacy fulfillment, and payment processing run on one platform, so a brand's patient records aren't spread across a separate form tool, video app, and pharmacy portal, each with its own vendor to chase after an incident.
Bask encrypts patient data at rest and in transit, which bears directly on the secured-information question for brands on the platform, though whether the data in a specific incident was secured to the standard in HHS guidance is still something the assessment has to establish. Its security page also lists two-factor authentication and system monitoring, logging, and alerting, and the platform keeps audit logs and maintains SOC 2 Type II compliance. Logs like these let a team reconstruct who accessed which records and when, which the four-factor assessment and patient notices both depend on, and which a brand needs before deciding who to tell.
Reach is the other variable. Brands on Bask can ship to patients in all 50 states through its pharmacy network, so a single incident can involve patients in many states, and the counts covered below must be broken out by state and totaled.
What Patients Have to Be Told
Send individual notice in writing by first-class mail, or by email if the patient has agreed to receive notices electronically. A brand that relies on email for everything should confirm it has that agreement on file and send the notice via HIPAA-compliant email. The deadline is the same either way: without unreasonable delay and no later than 60 days after discovery.
The notice must include:
- A brief description of the breach
- The types of information involved
- The steps patients should take to protect themselves
- What the organization is doing to investigate the breach, reduce the harm, and prevent a repeat
- Contact information for questions
When Contact Details Are Out of Date
Online patients change email addresses and move more often than a practice's records keep up. If contact information is insufficient or out of date for fewer than 10 people, the organization may give substitute notice by an alternative written form, by phone, or by other means. For 10 or more people, substitute notice means a notice on the website home page for at least 90 days or in major print or broadcast media, plus a toll-free number that stays active for at least 90 days.
Media and HHS Notices for Larger Breaches
Two thresholds apply here, and they count different things. Media notice is required when a breach affects more than 500 residents of a single state or jurisdiction. It goes to prominent media outlets serving that state, on the same deadline as the individual notices and with the same information.
Notice to HHS depends on the total. A breach affecting 500 or more people has to be reported to the Secretary without unreasonable delay and within 60 days, through the process HHS describes on its page on submitting notice of a breach. The difference catches multistate brands. A breach affecting 600 patients spread across several states, with no state above 500, needs an HHS report within 60 days but no media notice.
The Calendar-Year Report for Smaller Breaches
Breaches affecting fewer than 500 people still require individual notice within the same 60 days. You can wait to report to HHS and file it with the year's other small breaches, no later than 60 days after the end of the calendar year in which you discovered them. A breach discovered in March 2026 is therefore due to HHS within the first 60 days of 2027, while the patients involved should have heard about it in the spring.
FAQs
How Many Days Do You Have to Report a HIPAA Breach?
Patients must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people go to HHS on the same deadline. Smaller breaches can be reported to HHS within 60 days after the end of the calendar year.
Does Every Privacy Incident Count as a Breach?
No. An impermissible use or disclosure is presumed to be a breach unless a four-factor risk assessment shows a low probability of compromise, and three narrow exceptions fall outside the definition. Information that was properly encrypted or destroyed doesn't trigger notification.
What Does a Business Associate Owe the Covered Entity After a Breach?
Notice without unreasonable delay and no later than 60 days after it discovers the breach, including the identity of each affected individual to the extent possible.
Do State Breach Laws Also Apply?
They can. Many states have their own breach notification laws, with their own triggers and timelines, so check the states where affected patients live alongside the HIPAA requirements.
References
- U.S. Department of Health and Human Services. (n.d.). Breach notification rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- U.S. Department of Health and Human Services. (n.d.). Submitting notice of a breach to the Secretary. https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html
