45 CFR 164.406 Explained: When HIPAA Requires Media Notification After a Breach

45 CFR 164.406 sets the conditions under which you must notify the media after a HIPAA breach. This guide clarifies when media notice is required, what to say, and how to meet the breach notification timeline without missteps.

Breach Definition and Impact

Under HIPAA, a breach is the acquisition, access, use, or impermissible disclosure of unsecured protected health information (PHI) that compromises its security or privacy. “Unsecured” means the PHI was not rendered unusable, unreadable, or indecipherable to unauthorized persons (for example, through strong encryption or proper destruction).

Not every impermissible disclosure becomes a reportable breach. You must conduct a risk assessment to determine the probability that the PHI was compromised. Evaluate: (1) the nature and extent of PHI involved, (2) the unauthorized person who used or received it, (3) whether the PHI was actually viewed or acquired, and (4) the extent of mitigation achieved (such as obtaining reliable assurances of destruction or return).

Covered entities—health plans, most health care providers, and health care clearinghouses—remain responsible for breach notification even when a business associate is involved. Thorough documentation of your assessment and decisions is essential for compliance and accountability.

Media Notification Criteria

You must provide a media breach notification when a single incident involves more than 500 residents of a single State or jurisdiction. The duty is to notify prominent media serving that location; this is in addition to individual notices to affected persons.

If fewer than 500 residents of any one State or jurisdiction are affected, 45 CFR 164.406 does not require media notice. However, individual breach notification still applies, and you must report to the Secretary of HHS per HIPAA’s separate reporting rules. Keep counts by the individual’s last known residence to determine whether the threshold is met.

Do not confuse 164.406 media notice with “substitute notice” to individuals. Substitute notice via major print or broadcast media is permitted when you lack sufficient contact information for 10 or more affected individuals; that is a separate pathway and does not replace the media-notification trigger based on the 500‑resident threshold.

Notification Timeline and Deadlines

Issue media notification without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. Discovery occurs on the first day the breach is known—or by exercising reasonable diligence would have been known—to your organization.

Coordinate the notification timeline so media and individual notices are consistent and accurate. Begin investigations promptly, but remember the 60‑day outer limit runs from discovery, not from when your investigation concludes.

Law enforcement can require a delay if notification would impede a criminal investigation or threaten national security. Honor the specified delay period, documenting the request. When the delay lifts, proceed immediately with all required notices.

Content Requirements for Notifications

The content of a media notice must align with the § 164.404(c) requirements used for individual notices. Provide clear, plain‑language information that helps the public understand what happened and what to do next:

• A brief description of the incident, including the date of the breach and the date of discovery, if known.
• The types of unsecured PHI involved (for example, names, addresses, dates of birth, diagnoses, treatment information, account or identification numbers).
• Specific steps individuals should take to protect themselves from potential harm (such as monitoring accounts or explanation of benefits, placing fraud alerts, or changing passwords).
• What you are doing to investigate the breach, mitigate harm, and prevent future incidents.
• How individuals can obtain more information—include at least one: a toll‑free telephone number, an email address, a website, or a postal address.

Keep the statement factual and avoid including any PHI. Ensure that your media notice is consistent with individual notices and internal incident records.

Role of Prominent Media Outlets

“Prominent media” means outlets with substantial reach in the affected State or jurisdiction. In practice, you typically issue a press release to statewide or jurisdiction‑wide newspapers, major broadcast television and radio stations, and widely read digital newsrooms serving that area.

• Select outlets based on geographic coverage, audience size, and relevance to where affected residents live.
• Provide the full press release to news desks and assignment editors; offer a spokesperson and Q&A materials to ensure accuracy.
• Consider language access where appropriate, issuing notices in languages commonly spoken by affected residents.
• Maintain a record of when, where, and to whom the notice was sent, and keep copies for your HIPAA retention period.

Media notice complements, but never replaces, direct breach notification to individuals. Use consistent messaging across all channels to prevent confusion.

Urgent Additional Notice Procedures

When there is possible imminent misuse of PHI and time is of the essence, you may provide information to individuals by telephone or other means, in addition to the standard written notice. This urgent outreach can limit harm while you finalize the full breach notification package.

• Initiate rapid contact (for example, outbound calls, secure portals, or SMS where consent exists) with clear, action‑oriented guidance.
• Continue with required written individual notices and, if applicable, media notification under 45 CFR 164.406 within the established timeline.
• If you lack sufficient contact information for 10 or more affected individuals, use substitute notice methods, which may include major print or broadcast media in areas where they reside or a prominent website posting with a toll‑free number.
• Document your rationale for urgency, the steps taken, and the timing, and coordinate with law enforcement when applicable.

Key Takeaways

• Media notice is triggered when a breach affects more than 500 residents of a single State or jurisdiction.
• Deliver notices without unreasonable delay and no later than 60 days from discovery, unless a lawful delay applies.
• Align media content with § 164.404(c) requirements and keep messaging consistent across all breach notification channels.

FAQs

When is media notification required under 45 CFR 164.406?

Media notification is required when a breach of unsecured PHI affects more than 500 residents of a single State or jurisdiction. You must notify prominent media serving that location, in addition to providing individual notices to affected people.

What information must be included in a media breach notification?

Include the elements that mirror § 164.404(c) requirements: a brief description of the incident and relevant dates; the types of information involved; steps individuals should take to protect themselves; what your organization is doing to investigate, mitigate, and prevent future incidents; and clear contact methods (toll‑free phone, email, website, or postal address) for questions.

How soon must notifications be made after discovering a breach?

You must notify without unreasonable delay and no later than 60 calendar days after discovering the breach. If a law enforcement agency requests a delay to avoid impeding an investigation or harming national security, you must pause notices for the period they specify and proceed promptly once the delay ends.