SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-breaches-over-500

A breach affects more than 500 residents of one state. Who must be told besides the patients?

HHS and prominent media outlets serving that state.

Start playing free

  1. HHS and prominent media outlets in that state ✔
  2. Only the patients' insurance companies
  3. Only the local police department

Why: When a breach involves more than 500 residents of a state, the covered entity must also notify prominent media outlets there. Breaches of 500 or more people must be reported to HHS at the same time as patient notices.

Huh, didn't know that: HHS publishes a public list of breaches affecting 500 or more people.

The dad joke
Why did the big breach call the newspaper? The rule said it needed prominent media coverage.
Like this card?
Play the game

References

Answer: HHS and prominent media outlets in that state. When a breach involves more than 500 residents of a state, the covered entity must also notify prominent media outlets there. Breaches of 500 or more people must be reported to HHS at the same time as patient notices.

  1. 45 CFR 164.406 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.406
    involving more than 500 residents of a State or jurisdiction, a covered entity shall
    Checked 2026-10-10.
  2. 45 CFR 164.408(b) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.408
    For breaches of unsecured protected health information involving 500 or more individuals
    Checked 2026-10-10.
  3. HHS Breach Notification Rule www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
    Breaches of Unsecured Protected Health Information affecting 500 or more individuals. View a list of these breaches.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.