# HIPAA Breach Notification — Standards and References

## Primary Legal Sources

### Code of Federal Regulations
- **45 CFR Part 164, Subpart D** — Notification in the Case of Breach of Unsecured Protected Health Information (§164.400-414)
- **45 CFR §164.400** — Applicability
- **45 CFR §164.402** — Definitions (breach, unsecured PHI, discovery)
- **45 CFR §164.404** — Individual notification requirements
- **45 CFR §164.406** — Media notification requirements
- **45 CFR §164.408** — HHS Secretary notification requirements
- **45 CFR §164.410** — Business associate notification to covered entity
- **45 CFR §164.412** — Law enforcement delay provision
- **45 CFR §164.414** — Administrative requirements and burden of proof

### Statutes
- **HITECH Act §13402** — Notification in the Case of Breach (established breach notification requirement)
- **HITECH Act §13402(h)** — Unsecured PHI and technologies rendering PHI unusable/unreadable

### Federal Register
- **74 FR 42740** — Breach Notification for Unsecured PHI; Interim Final Rule (August 24, 2009)
- **74 FR 19006** — Guidance Specifying the Technologies and Methodologies That Render PHI Unusable, Unreadable, or Indecipherable (April 27, 2009)
- **78 FR 5566** — Omnibus Rule (final breach notification provisions with "low probability of compromise" standard)

## OCR Guidance
- **OCR Breach Notification Rule Summary** — published at hhs.gov/hipaa/for-professionals/breach-notification
- **OCR Breach Portal** — ocrportal.hhs.gov/ocr/breach/breach_report.jsf — public database of breaches affecting 500+
- **OCR Breach Reporting Portal Instructions** — step-by-step guide for HHS notification submission
- **HHS Guidance on Unsecured PHI** — technologies and methodologies for the encryption/destruction safe harbor

## Encryption Safe Harbor
- **NIST SP 800-111** — Guide to Storage Encryption Technologies for End User Devices (data at rest encryption standard)
- **FIPS 140-2/140-3** — Security Requirements for Cryptographic Modules (encryption validation standard)
- **NIST SP 800-88 Rev. 1** — Guidelines for Media Sanitization (destruction standard)

## State Breach Notification Laws
- All 50 states, DC, Guam, Puerto Rico, and the US Virgin Islands have breach notification laws
- State laws may impose additional requirements (shorter notification timelines, expanded definition of personal information, specific content requirements, credit monitoring mandates)
- State AG notification requirements vary by jurisdiction