164.404-410 — Breach notification to individuals, HHS and the media

Requirement

Following the discovery of a breach of unsecured protected health information, notify each affected individual without unreasonable delay and no later than 60 days after discovery (§164.404); for a breach affecting more than 500 residents of a state or jurisdiction, also notify prominent media outlets (§164.406); notify HHS — within the same 60-day window for breaches affecting 500 or more individuals, and within 60 days of the end of the calendar year for smaller ones (§164.408). A business associate must notify the covered entity (§164.410).

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.