SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-60-day-breach-notice

Within how many days must individuals be notified of a breach?

No later than 60 calendar days after the breach is discovered.

Start playing free

  1. 30 days
  2. 90 days
  3. 60 days ✔

Why: Patients must be told without unreasonable delay and no later than 60 calendar days after the breach is discovered. Sixty days is the outer limit, not a waiting period.

Huh, didn't know that: A law enforcement official can ask for a delay if notice would hurt a criminal investigation; a spoken request covers up to 30 days.

The dad joke
Why did the breach letter leave early? It did not want to be late for its 60-day deadline.
Like this card?
Play the game

References

Answer: 60 days. Patients must be told without unreasonable delay and no later than 60 calendar days after the breach is discovered. Sixty days is the outer limit, not a waiting period.

  1. 45 CFR 164.404(b) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
    without unreasonable delay and in no case later than 60 calendar days after discovery of a breach
    Checked 2026-10-10.
  2. 45 CFR 164.412 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.412
    no longer than 30 days from the date of the oral statement
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.