---
kind: "section"
citation: "42 U.S.C. § 17932"
title: "42"
title_heading: "The Public Health and Welfare"
number: "17932"
heading: "Notification in the case of breach"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/42/17932"
units:
  - "Chapter 156 — Health Information Technology"
  - "Subchapter III — Privacy"
  - "Part A — Improved Privacy Provisions and Security Provisions"
---

# §17932. Notification in the case of breach

- (a) **In general—** A [covered entity](/usc/42/17921.md?p=3) that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or [discloses](/usc/42/17921.md?p=4) unsecured [protected health information](/usc/42/17921.md?p=12) (as defined in [subsection (h)(1)](#h-1)) shall, in the case of a [breach](/usc/42/17921.md?p=1-A) of such information that is discovered by the [covered entity](/usc/42/17921.md?p=3), notify each individual whose unsecured [protected health information](/usc/42/17921.md?p=12) has been, or is reasonably believed by the [covered entity](/usc/42/17921.md?p=3) to have been, accessed, acquired, or disclosed as a result of such [breach](/usc/42/17921.md?p=1-A).
- (b) **Notification of covered entity by business associate—** A [business associate](/usc/42/17921.md?p=2) of a [covered entity](/usc/42/17921.md?p=3) that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or [discloses](/usc/42/17921.md?p=4) unsecured [protected health information](/usc/42/17921.md?p=12) shall, following the discovery of a [breach](/usc/42/17921.md?p=1-A) of such information, notify the [covered entity](/usc/42/17921.md?p=3) of such [breach](/usc/42/17921.md?p=1-A). Such notice shall include the identification of each individual whose unsecured [protected health information](/usc/42/17921.md?p=12) has been, or is reasonably believed by the [business associate](/usc/42/17921.md?p=2) to have been, accessed, acquired, or disclosed during such [breach](/usc/42/17921.md?p=1-A).
- (c) **Breaches treated as discovered—** For purposes of this section, a [breach](/usc/42/17921.md?p=1-A) shall be treated as discovered by a [covered entity](/usc/42/17921.md?p=3) or by a [business associate](/usc/42/17921.md?p=2) as of the first day on which such [breach](/usc/42/17921.md?p=1-A) is known to such entity or associate, respectively, (including any person, other than the individual committing the [breach](/usc/42/17921.md?p=1-A), that is an employee, officer, or other agent of such entity or associate, respectively) or should reasonably have been known to such entity or associate (or person) to have occurred.
- (d) **Timeliness of notification—**
  - (1) **In general—** Subject to [subsection (g)](#g), all notifications required under this section shall be made without unreasonable delay and in no case later than 60 calendar days after the discovery of a [breach](/usc/42/17921.md?p=1-A) by the [covered entity](/usc/42/17921.md?p=3) involved (or [business associate](/usc/42/17921.md?p=2) involved in the case of a notification required under [subsection (b)](#b)).
  - (2) **Burden of proof—** The [covered entity](/usc/42/17921.md?p=3) involved (or [business associate](/usc/42/17921.md?p=2) involved in the case of a notification required under [subsection (b)](#b)), shall have the burden of demonstrating that all notifications were made as required under this part, including evidence demonstrating the necessity of any delay.
- (e) **Methods of notice—**
  - (1) **Individual notice—** Notice required under this section to be provided to an individual, with respect to a [breach](/usc/42/17921.md?p=1-A), shall be provided promptly and in the following form:
    - (A) Written notification by first-class mail to the individual (or the next of kin of the individual if the individual is deceased) at the last known address of the individual or the next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. The notification may be provided in one or more mailings as information is available.
    - (B) In the case in which there is insufficient, or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes direct written (or, if specified by the individual under [subparagraph (A)](#e-1-A), electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are 10 or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting for a period determined by the [Secretary](/usc/42/17921.md?p=13) on the home page of the Web site of the [covered entity](/usc/42/17921.md?p=3) involved or notice in major print or broadcast media, including major media in geographic areas where the individuals affected by the [breach](/usc/42/17921.md?p=1-A) likely reside. Such a notice in media or web posting will include a toll-free phone number where an individual can learn whether or not the individual’s unsecured [protected health information](/usc/42/17921.md?p=12) is possibly included in the [breach](/usc/42/17921.md?p=1-A).
    - (C) In any case deemed by the [covered entity](/usc/42/17921.md?p=3) involved to require urgency because of possible imminent misuse of unsecured [protected health information](/usc/42/17921.md?p=12), the [covered entity](/usc/42/17921.md?p=3), in addition to notice provided under [subparagraph (A)](#e-1-A), may provide information to individuals by telephone or other means, as appropriate.
  - (2) **Media notice—** Notice shall be provided to prominent media outlets serving a [State](/usc/42/17921.md?p=15) or jurisdiction, following the discovery of a [breach](/usc/42/17921.md?p=1-A) described in [subsection (a)](#a), if the unsecured [protected health information](/usc/42/17921.md?p=12) of more than 500 residents of such [State](/usc/42/17921.md?p=15) or jurisdiction is, or is reasonably believed to have been, accessed, acquired, or disclosed during such [breach](/usc/42/17921.md?p=1-A).
  - (3) **Notice to Secretary—** Notice shall be provided to the [Secretary](/usc/42/17921.md?p=13) by [covered entities](/usc/42/17921.md?p=3) of unsecured [protected health information](/usc/42/17921.md?p=12) that has been acquired or disclosed in a [breach](/usc/42/17921.md?p=1-A). If the [breach](/usc/42/17921.md?p=1-A) was with respect to 500 or more individuals than[^1] such notice must be provided immediately. If the [breach](/usc/42/17921.md?p=1-A) was with respect to less than 500 individuals, the [covered entity](/usc/42/17921.md?p=3) may maintain a log of any such [breach](/usc/42/17921.md?p=1-A) occurring and annually submit such a log to the [Secretary](/usc/42/17921.md?p=13) documenting such [breaches](/usc/42/17921.md?p=1-A) occurring during the year involved.
  - (4) **Posting on HHS public website—** The [Secretary](/usc/42/17921.md?p=13) shall make available to the public on the Internet website of the Department of Health and Human Services a list that identifies each [covered entity](/usc/42/17921.md?p=3) involved in a [breach](/usc/42/17921.md?p=1-A) described in [subsection (a)](#a) in which the unsecured [protected health information](/usc/42/17921.md?p=12) of more than 500 individuals is acquired or disclosed.
- (f) **Content of notification—** Regardless of the method by which notice is provided to individuals under this section, notice of a [breach](/usc/42/17921.md?p=1-A) shall include, to the extent possible, the following:
  - (1) A brief description of what happened, including the date of the [breach](/usc/42/17921.md?p=1-A) and the date of the discovery of the [breach](/usc/42/17921.md?p=1-A), if known.
  - (2) A description of the types of unsecured [protected health information](/usc/42/17921.md?p=12) that were involved in the [breach](/usc/42/17921.md?p=1-A) (such as full name, Social [Security](/usc/42/17921.md?p=14) number, date of birth, home address, account number, or disability code).
  - (3) The steps individuals should take to protect themselves from potential harm resulting from the [breach](/usc/42/17921.md?p=1-A).
  - (4) A brief description of what the [covered entity](/usc/42/17921.md?p=3) involved is doing to investigate the [breach](/usc/42/17921.md?p=1-A), to mitigate losses, and to protect against any further [breaches](/usc/42/17921.md?p=1-A).
  - (5) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.
- (g) **Delay of notification authorized for law enforcement purposes—** If a law enforcement official determines that a notification, notice, or posting required under this section would impede a criminal investigation or cause damage to national [security](/usc/42/17921.md?p=14), such notification, notice, or posting shall be delayed in the same manner as provided under section 164.528(a)(2) of title 45, Code of Federal Regulations, in the case of a [disclosure](/usc/42/17921.md?p=4) covered under such section.
- (h) **Unsecured protected health information—**
  - (1) **Definition—**
    - (A) **In general—** Subject to [subparagraph (B)](#h-1-B), for purposes of this section, the term “unsecured [protected health information](/usc/42/17921.md?p=12)” means [protected health information](/usc/42/17921.md?p=12) that is not secured through the use of a technology or methodology specified by the [Secretary](/usc/42/17921.md?p=13) in the guidance issued under [paragraph (2)](#h-2).
    - (B) **Exception in case timely guidance not issued—** In the case that the [Secretary](/usc/42/17921.md?p=13) does not issue guidance under [paragraph (2)](#h-2) by the date specified in such paragraph, for purposes of this section, the term “unsecured [protected health information](/usc/42/17921.md?p=12)” shall mean [protected health information](/usc/42/17921.md?p=12) that is not secured by a technology standard that renders [protected health information](/usc/42/17921.md?p=12) unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute.
  - (2) **Guidance—** For purposes of [paragraph (1)](#h-1) and [section 17937(f)(3) of this title](/usc/42/17937.md?p=f-3), not later than the date that is 60 days after February 17, 2009, the [Secretary](/usc/42/17921.md?p=13) shall, after consultation with stakeholders, issue (and annually update) guidance specifying the technologies and methodologies that render [protected health information](/usc/42/17921.md?p=12) unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under [section 300jj–12(b)(2)(B)(vi)](/usc/42/300jj–12.md)[^2] of this title, as added by [section 13101](/usc/42/13101.md) of this Act.
- (i) **Report to Congress on breaches—**
  - (1) **In general—** Not later than 12 months after February 17, 2009, and annually thereafter, the [Secretary](/usc/42/17921.md?p=13) shall prepare and submit to the Committee on Finance and the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report containing the information described in [paragraph (2)](#i-2) regarding [breaches](/usc/42/17921.md?p=1-A) for which notice was provided to the [Secretary](/usc/42/17921.md?p=13) under [subsection (e)(3)](#e-3).
  - (2) **Information—** The information described in this paragraph regarding [breaches](/usc/42/17921.md?p=1-A) specified in [paragraph (1)](#i-1) shall include—
    - (A) the number and nature of such [breaches](/usc/42/17921.md?p=1-A); and
    - (B) actions taken in response to such [breaches](/usc/42/17921.md?p=1-A).
- (j) **Regulations; effective date—** To carry out this section, the [Secretary](/usc/42/17921.md?p=13) of Health and Human Services shall promulgate interim final regulations by not later than the date that is 180 days after February 17, 2009. The provisions of this section shall apply to [breaches](/usc/42/17921.md?p=1-A) that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations.

## Footnotes

[^1]: So in orginal. Probably should be “then”.
[^2]: See References in Text note below.

## Source credit

(Pub. L. 111–5, div. A, title XIII, § 13402, Feb. 17, 2009, 123 Stat. 260.)

## Notes

### Editorial Notes

### References in Text

Section 300jj–12(b)(2)(B)(vi) of this title, referred to in subsec. (h)(2), was repealed by Pub. L. 114–255, div. A, title IV, § 4003(e)(1), Dec. 13, 2016, 130 Stat. 1168. Similar provisions as pertaining to the HIT Advisory Committee are contained in section 300jj–12(b)(2)(C)(vii) of this title as enacted by Pub. L. 114–255.

Section 13101 of this Act, referred to in subsec. (h)(2), means section 13101 of div. A of Pub. L. 111–5.

### Statutory Notes and Related Subsidiaries

### Effective Date

Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title.