SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-breach-discovery

When is a breach considered discovered?

On the first day it is known, or would have been known with reasonable care.

Start playing free

  1. Only when a patient complains
  2. 30 days after it happens
  3. When it is known or should have been known ✔

Why: A breach counts as discovered on the first day the organization knew, or with reasonable diligence would have known, about it. That date starts the 60-day notice clock.

Huh, didn't know that: Knowledge of the person who committed the breach does not count toward discovery.

The dad joke
When does a breach get its birthday? The day it is discovered.
Like this card?
Play the game

References

Answer: When it is known or should have been known. A breach counts as discovered on the first day the organization knew, or with reasonable diligence would have known, about it. That date starts the 60-day notice clock.

  1. 45 CFR 164.404(a)(2) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
    treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.