The 60-Day Countdown: What Small Practices Get Wrong About Breach Notification
HIPAA gives covered entities 60 days from the discovery of a breach to notify affected patients, and in many cases the Department of Health and Human Services as well. Sixty days sounds like plenty of time, until a practice actually has an incident and realizes it has no documented plan for what to do, who to call, or when the clock even started.
Why the Clock Starts Before Most Practices Realize It
The 60-day window doesn't start when a practice finishes investigating an incident. It starts on the date the breach was discovered, or reasonably should have been discovered. Practices without monitoring in place often don't discover an incident until weeks after it happened, which compresses the time left to investigate, notify, and document everything correctly.
What Goes Wrong Without a Plan
Without a documented incident response plan, the first hours and days after a suspected breach are spent figuring out basic questions: who is in charge, which systems need to be isolated, what counts as PHI in this specific incident, and who legally needs to be notified. That confusion eats into the 60-day window and increases the odds of a late or incomplete notification, which carries its own separate penalties on top of the underlying breach.
What Practices Need in Place Before an Incident Happens
A workable plan identifies, in advance, who leads the response, how an incident gets detected and confirmed, what the notification requirements are for patients and regulators, and how the practice documents every step it took. It also depends on actually having a way to detect incidents in the first place, since a plan is only useful if someone finds out about the breach with enough time left to act.
How Consolidated IT Solutions Can Help
Consolidated IT Solutions helps small practices get ahead of the 60-day clock instead of racing it, including:
- Building and testing a documented incident response plan tailored to your practice
- Breach detection tools so incidents are found in days, not months
- Acting as your first responder if an incident does happen
- Clear notification checklists covering patients, HHS, and other required parties
- Post-incident documentation to support any required reporting