---
kind: "section"
citation: "45 C.F.R. § 164.408"
title: "45"
number: "164.408"
heading: "Notification to the Secretary."
url: "https://uscodex.org/cfr/45/164.408"
---

# §164.408. Notification to the Secretary.

- (a) **Standard.** A covered entity shall, following the discovery of a breach of unsecured protected health information as provided in [§ 164.404(a)(2)](/cfr/45/164.404.md?p=a-2), notify the Secretary.
- (b) **Implementation specifications: Breaches involving 500 or more individuals.** For breaches of unsecured protected health information involving 500 or more individuals, a covered entity shall, except as provided in [§ 164.412](/cfr/45/164.412.md), provide the notification required by [paragraph (a)](#a) of this section contemporaneously with the notice required by [§ 164.404(a)](/cfr/45/164.404.md?p=a) and in the manner specified on the HHS Web site.
- (c) **Implementation specifications: Breaches involving less than 500 individuals.** For breaches of unsecured protected health information involving less than 500 individuals, a covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provide the notification required by [paragraph (a)](#a) of this section for breaches discovered during the preceding calendar year, in the manner specified on the HHS web site.

## Notes

### Amendments

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

### Source

Source: 74 FR 42767, Aug. 24, 2009, unless otherwise noted.

### Authority

Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

### Source

Source: 65 FR 82802, Dec. 28, 2000, unless otherwise noted.

### Amendments

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]