SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-small-breach-log

How are breaches affecting fewer than 500 people reported?

They are logged and reported to HHS once a year.

Start playing free

  1. A phone call to HHS within 24 hours
  2. An internal memo only, never sent to HHS
  3. A log sent to HHS once a year ✔

Why: For breaches of fewer than 500 people, the covered entity keeps a log and reports them to HHS yearly. The patients themselves still get their notices within 60 days.

Huh, didn't know that: The yearly report is due no later than 60 days after the end of the calendar year.

The dad joke
Why did the small breach keep a diary? It had to log everything for the yearly report.
Like this card?
Play the game

References

Answer: A log sent to HHS once a year. For breaches of fewer than 500 people, the covered entity keeps a log and reports them to HHS yearly. The patients themselves still get their notices within 60 days.

  1. 45 CFR 164.408(c) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.408
    shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.