SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-breach-notification-content

What must a breach notification letter include?

What happened and what patients can do to protect themselves, plus how to get more information.

Start playing free

  1. Only an apology
  2. The patient's full medical record
  3. What happened and steps patients can take ✔

Why: A breach letter must describe what happened, what kinds of PHI were involved, steps people should take, what the organization is doing, and how to contact it, such as a toll-free number.

Huh, didn't know that: The notice must be written in plain language.

The dad joke
Why was the breach letter so popular? It finally told people what to do.
Like this card?
Play the game

References

Answer: What happened and steps patients can take. A breach letter must describe what happened, what kinds of PHI were involved, steps people should take, what the organization is doing, and how to contact it, such as a toll-free number.

  1. 45 CFR 164.404(c) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
    A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.