What a Compliant Health-Data Notice Must Do
This chapter follows the Federal Trade Commission’s Health Breach Notification Rule from the moment a qualifying breach is discovered to the moment notice reaches the people and institutions that need it. The focus is the rule’s practical remedy: how timing, thresholds, delivery channels, and plain-language content turn a distributed health-data incident into an accountable event. The result is a way to read the rule as a lifecycle rather than as a pile of deadlines, while keeping clear that notification is not the same as comprehensive privacy protection.
The clock starts when the breach is known
The rule treats a breach as discovered on the first day it is known or reasonably should have been known to the vendor of personal health records, PHR related entity, or third-party service provider. Knowledge by an employee, officer, or other agent generally counts as knowledge by the relevant organization, except for the person who committed the breach. That rule matters because an organization cannot necessarily postpone the clock until its investigation is complete or until the most senior person receives a report.
The main deadline is also deliberately two-part. Required notices to individuals, the media, and the vendor or related entity are due without unreasonable delay and in no case later than 60 calendar days after discovery. Sixty days is an outer limit, not an automatic waiting period. The Commission explains that waiting until the last day can itself be unreasonable when an organization has gathered the necessary information and has systems ready to send notice earlier.
The FTC deadline depends on the number of individuals affected. When a breach involves the unsecured PHR identifiable health information of 500 or more individuals, notice to the FTC must be provided at the same time as the notice to individuals. The Commission changed the earlier ten-business-day deadline so that a large or complicated incident can be investigated sufficiently to produce a complete notice, while still requiring the FTC notice without unreasonable delay and no later than the individual notice.
When fewer than 500 individuals are involved, the vendor or PHR related entity may keep a log of the breach and submit that log to the FTC annually. The annual report is due no later than 60 days after the end of the calendar year. This creates a different reporting rhythm for smaller incidents: individuals still receive notice within the ordinary 60-day outer limit, but the FTC can receive a consolidated record rather than a separate immediate report for every event.
Media notice has its own threshold. A vendor or PHR related entity must notify prominent media outlets serving a state or jurisdiction when the unsecured PHR identifiable health information of 500 or more residents of that state or jurisdiction was, or is reasonably believed to have been, acquired. The threshold is tied to the residents of the relevant state or jurisdiction, not simply to the organization’s total user base. A single national incident may therefore require attention to the geographic distribution of affected people.
The rule places the burden of demonstrating compliance on the vendor, PHR related entity, and third-party service provider involved. That includes evidence showing why any delay was necessary. The requirement turns the timeline into more than an aspiration: an organization should be able to reconstruct when it knew of the incident, what it learned, when it sent each notice, and why a law-enforcement exception or another delay applied.