HIPAA: report breaches affecting fewer than 500 people to HHS
A covered entity must report breaches of unsecured protected health information involving fewer than 500 individuals to HHS not later than 60 days after the end of each calendar year, for breaches discovered during the preceding year.
Source: HHS Office for Civil Rights · 45 CFR 164 · Checked automatically Oct 6, 2026