{"data":{"id":"us/45-cfr-164.406","jurisdiction":"us","citation":"45 CFR 164.406","heading":"Notification to the media.","body":"(a) Standard. For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in § 164.404(a)(2), notify prominent media outlets serving the State or jurisdiction.\n(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.\n(c) Implementation specifications: Content of notification. The notification required by paragraph (a) of this section shall meet the requirements of § 164.404(c).","path":["Title 45—Public Welfare","SUBTITLE A—Department of Health and Human Services","SUBCHAPTER C—ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS","PART 164—SECURITY AND PRIVACY","Subpart D—Notification in the Case of Breach of Unsecured Protected Health Information"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-45.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:26:21Z","sha256":"f441e3e30f081394057034d9c3a48cfaf8599406e34d3bada004335a1c426b5c","source_id":"us-cfr","stale":true,"prev":"us/45-cfr-164.404","next":"us/45-cfr-164.408"},"notice":"GroundRules: Original legal text. Not legal advice."}