45 CFR 164.406
§ 164.406 Notification to the media.
United States · 45 CFR — Public Welfare · Status: effective
Cite this
- Citation
- 45 CFR 164.406, § 164.406 Notification to the media, United States, version 1 as recorded 2026-07-09, yourstate.us, https://yourstate.us/provision/218079
- Permanent ID
ys:prov:218079@1- SHA-256
c1c0d4c82dfadc9d9c004cfff3bc42397b385ef93904357039a2d56b1ca8afc2
The hash is SHA-256 of this version's text, with every run of whitespace collapsed to a single space and the ends trimmed. The ID always leads back here, and checking it says whether the text you cited is still the current version.
Full text
(a) Standard. For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in § 164.404(a)(2), notify prominent media outlets serving the State or jurisdiction.
(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
(c) Implementation specifications: Content of notification. The notification required by paragraph (a) of this section shall meet the requirements of § 164.404(c).
Legislative history
This is a federal regulation, adopted through agency rulemaking under the Administrative Procedure Act — not enacted by a recorded vote of Congress.