---
kind: "section"
citation: "45 C.F.R. § 164.406"
title: "45"
number: "164.406"
heading: "Notification to the media."
url: "https://uscodex.org/cfr/45/164.406"
---

# §164.406. Notification to the media.

- (a) **Standard.** For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in [§ 164.404(a)(2)](/cfr/45/164.404.md?p=a-2), notify prominent media outlets serving the State or jurisdiction.
- (b) **Implementation specification: Timeliness of notification.** Except as provided in [§ 164.412](/cfr/45/164.412.md), a covered entity shall provide the notification required by [paragraph (a)](#a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
- (c) **Implementation specifications: Content of notification.** The notification required by [paragraph (a)](#a) of this section shall meet the requirements of [§ 164.404(c)](/cfr/45/164.404.md?p=c).

## Notes

### Amendments

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

### Source

Source: 74 FR 42767, Aug. 24, 2009, unless otherwise noted.

### Authority

Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Source

Source: 65 FR 82802, Dec. 28, 2000, unless otherwise noted.

### Amendments

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]