SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-substitute-notice

When is substitute notice used for breach notification?

When contact information is missing or out of date for 10 or more people.

Start playing free

  1. When the breach affects fewer than 10 people
  2. Only when the media already reported it
  3. When contact information is missing for 10 or more people ✔

Why: If the covered entity lacks good contact information for 10 or more people, it must post a notice on its website home page for 90 days or use major print or broadcast media, plus a toll-free number active for 90 days.

Huh, didn't know that: For fewer than 10 people, another written notice, a phone call or other means can be used instead.

The dad joke
What does a breach letter do when the address is wrong? It goes on the website instead.
Like this card?
Play the game

References

Answer: When contact information is missing for 10 or more people. If the covered entity lacks good contact information for 10 or more people, it must post a notice on its website home page for 90 days or use major print or broadcast media, plus a toll-free number active for 90 days.

  1. 45 CFR 164.404(d)(2) (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
    In the case in which there is insufficient or out-of-date contact information for 10 or more individuals
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is a HIPAA breach?Work SkillsIs every impermissible PHI disclosure a breach?Work SkillsHow many factors are used in a HIPAA breach risk assessment?

That's stuff everyone should know.