A healthcare practice may learn about a cyber incident from its billing company, cloud software provider, transcription service, or another business associate. The first question is not simply whether the vendor promises to investigate. It is what protected health information may have been affected, when the event was discovered, and who has which notification duty. A proactive contract review should also address HIPAA security obligations in healthcare SaaS agreements.
The business associate and covered entity have different duties
Under the HIPAA Breach Notification Rule, a business associate generally must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery, subject to applicable regulatory qualifications. A business associate agreement may set a much shorter notice requirement.
The covered entity’s potential duties to affected individuals, HHS, and in some circumstances the media are separate. The outer 60-day rule should not be treated as permission to postpone investigating or notifying until the last possible date.
Preserve the facts that start the clock
Identify the first indication of the incident, when someone acting for the organization knew or reasonably should have known of it, the systems and data involved, the period of unauthorized access, and the actions taken to contain it. Preserve vendor incident tickets, contractual notices, emails, access logs, and forensic work products under an appropriate plan.
Not every security incident is automatically a reportable HIPAA breach. The applicable breach definition, exceptions, whether data were secured, and a documented risk assessment matter. Counsel and security personnel should coordinate without assuming that calling a report ‘privileged’ makes underlying facts disappear.
Read the contract alongside the regulation
A strong BAA and services agreement should address rapid escalation, availability of logs, subcontractors, costs, cooperation with notifications, preservation, security control responsibilities, and insurance. The regulatory timeline and a contractual deadline can be different.
Providers also need to identify whether state breach-notification laws, payer contracts, insurance policies, or other obligations apply. One event can generate overlapping duties with different thresholds or recipients.
A first-day response checklist
Appoint an internal decision-maker; confirm the vendor’s incident contact; require a written initial fact summary; preserve affected data and system logs; identify impacted individuals and jurisdictions; and calendar legal and contractual notice deadlines. Do not upload patient-specific details to a public contact form.
After containment, use the incident to revisit who owns data, who can disable access, whether subcontractors were approved, and whether a vendor can provide the evidence a regulator or patient will request.
Determine whether the incident is a reportable breach
HIPAA’s Breach Notification Rule does not treat every technical incident as a proven reportable breach. An impermissible use or disclosure of unsecured protected health information is generally presumed to be a breach unless a documented assessment demonstrates a low probability of compromise or an exception applies. The required assessment considers the information involved, the unauthorized recipient, whether information was acquired or viewed, and the extent of mitigation. Encryption and the status of affected devices can materially change that analysis. Request the vendor’s incident chronology, audit logs, access evidence, data categories, affected patient identifiers and forensic findings. Preserve each successive vendor explanation, including corrections. A statement that the event was contained is not enough if the organization cannot explain when access occurred and what was protected.
Separate the contractual response from HIPAA deadlines
A business associate generally must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery under 45 C.F.R. § 164.410. A business associate agreement may require much faster reporting and cooperation. The covered entity ordinarily has its own individual notification duties under § 164.404, including the requirement to act without unreasonable delay and generally no later than 60 calendar days after the applicable discovery date. A late vendor report does not automatically restart the provider’s legal clock. Investigate who knew what, when knowledge became attributable, and whether a lawful delay applies. Contract provisions can allocate notice work and costs but cannot simply erase statutory accountability.
Notification depends on affected people and location
For breaches affecting 500 or more individuals, notice to the HHS Secretary is generally due without unreasonable delay and within 60 calendar days. Smaller breaches can be reported on the annual timetable. If more than 500 residents of a state or jurisdiction are affected, media notification may also be required. Patient notices must describe the incident, categories of information, protective steps and response contact information to the extent available, and must use permissible delivery methods. Count the affected population carefully and preserve evidence supporting the number. State-law obligations may also require action even where the federal analysis is different. The correct response is not a mass email sent before facts are verified or an indefinite delay awaiting perfect information.
Preserve patient continuity and correct the process
An EHR breach or vendor outage can affect access to lab results, prescriptions, medication reconciliation and referrals. The practice should maintain a lawful downtime process, identify patients whose treatment may be interrupted, protect backup records and reconcile new documentation after restoration. Record when the incident team acted, what systems were secured, which records were preserved and who approved risk and notice decisions. After containment, test vendor escalation clauses, backup access, workforce training and breach-response procedures. Do not blame the vendor in place of analysis. The practice’s own dated record should explain why it believed notification was or was not required, what uncertainty remained, and what corrective measures were actually implemented.
Sources and authorities
Need advice on a specific notice or dispute? Request Healthcare Counsel or send a brief nonconfidential inquiry. BOLO Health Law is based in New Jersey. This general educational article is not legal advice; contact does not establish an attorney-client relationship.