Short answer: For 500 or more people, notify HHS at the same time as the individuals. For fewer than 500, log it and report to HHS within 60 days after the end of the calendar year it was discovered. Media notice is required when more than 500 residents of one state are affected.
Every affected individual gets written notice without unreasonable delay and no later than 60 calendar days after the breach is discovered. On top of that:
- 500 or more people (total): notify HHS contemporaneously with the individual notices, through the HHS breach portal.
- Fewer than 500: keep a log and submit the year’s breaches to HHS no later than 60 days after the end of the calendar year in which they were discovered (roughly March 1).
- More than 500 residents of one state or jurisdiction: also notify prominent media outlets serving that area within the same 60 days.
Sixty days is a ceiling, not a target: holding notices that were ready earlier is itself an unreasonable delay. A breach is “discovered” the first day anyone in the workforce or any agent (other than the person who caused it) knew or reasonably should have known. Texas residents may also trigger the state’s separate notice rules.