SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-business-associate-breach

Who must notify patients if a business associate has a breach?

The covered entity notifies patients; the business associate tells the covered entity.

Start playing free

  1. The covered entity, after the business associate tells it ✔
  2. Only HHS notifies the patients
  3. The patients' insurance companies

Why: A business associate must tell the covered entity about a breach. The covered entity is then responsible for notifying the affected patients, though they can agree to have the business associate do it.

Huh, didn't know that: A business associate has no more than 60 days after discovery to tell the covered entity.

The dad joke
Why did the billing company call the clinic first? It knew who had to send the letters.
Like this card?
Play the game

References

Answer: The covered entity, after the business associate tells it. A business associate must tell the covered entity about a breach. The covered entity is then responsible for notifying the affected patients, though they can agree to have the business associate do it.

  1. 45 CFR 164.410 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.410
    A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity
    Checked 2026-10-10.
  2. HHS Breach Notification Rule www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
    A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.