A 90-minute email account compromise cost Lucent Health Solutions up to $1.95 million in settlement costs and 15 months of reputational damage. This guide walks you through the regulatory requirements, notification timelines, and incident response decisions that determine whether your organization faces a six-figure settlement or a defensible breach response.
Scope - What This Guide Covers
This guide addresses the post-breach notification and response obligations under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and HIPAA Privacy Rule, with emphasis on the HITECH Act's breach notification requirements. You'll find specific timelines, documentation requirements, and decision frameworks for determining breach scope and notification obligations when electronic protected health information (ePHI) is potentially compromised.
This guide does not cover pre-breach prevention controls or forensic investigation techniques. It starts after you've confirmed unauthorized access occurred.
Key Concepts and Definitions
Breach: Under the HITECH Act, a breach is an impermissible use or disclosure of protected health information that compromises its security or privacy. You must presume a breach occurred unless you can demonstrate a low probability that the information was compromised through a risk assessment.
Unsecured Protected Health Information: PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction methods specified in NIST guidance.
Risk Assessment: The four-factor analysis required under 45 CFR § 164.402(2) to determine if unauthorized access constitutes a reportable breach:
- Nature and extent of PHI involved
- Unauthorized person who accessed the information
- Whether PHI was actually acquired or viewed
- Extent to which risk has been mitigated
Notification Deadline: The HITECH Act requires notification "without unreasonable delay and in no case later than 60 calendar days" from discovery of the breach.
Requirements Breakdown
Discovery Triggers (45 CFR § 164.404)
Discovery occurs when you or any workforce member or agent first know, or reasonably should have known, of a breach. In the Lucent case, discovery occurred in October 2023 when the phishing attack was identified. The 60-day clock started then, not 15 months later when notifications actually went out.
Your discovery obligations:
- Security monitoring tools flag suspicious access
- Help desk receives credential compromise reports
- Forensic investigation confirms unauthorized access
- Any workforce member becomes aware of potential breach
Individual Notification Requirements (45 CFR § 164.404(c))
You must notify each affected individual by first-class mail to their last known address, or by email if they've agreed to electronic notice. Your notification must include:
- Brief description of what happened
- Types of unsecured PHI involved
- Steps individuals should take to protect themselves
- What you're doing to investigate and mitigate harm
- Contact procedures for questions
For breaches affecting 500+ individuals, you must also notify prominent media outlets serving the affected area and submit notice to the HHS Secretary contemporaneously with individual notification.
The 60-Day Calculation
Count 60 calendar days from discovery, not from the incident date. If day 60 falls on a weekend or federal holiday, your deadline extends to the next business day.
Critical: "Without unreasonable delay" means you can't wait until day 59 just because it's within the statutory window. Document why you needed the time you took.
Implementation Guidance
Phase 1: Immediate Assessment (Days 1-5)
Execute your four-factor risk assessment immediately. Document:
- Exactly what PHI fields were in the compromised system
- Who had unauthorized access (internal vs. external threat actor)
- Evidence of actual viewing or exfiltration
- Mitigating factors (encryption status, access controls, time window)
In the Lucent incident, the 90-minute access window and lack of exfiltration evidence were relevant mitigating factors, but the presence of names, dates of birth, Social Security numbers, and plan numbers in an unencrypted email account meant the presumption of breach applied.
Phase 2: Scope Determination (Days 6-15)
Build your affected individual list. You need:
- Full names and last known addresses
- Contact information (phone, email if available)
- Specific PHI fields exposed for each individual
If you can't determine exactly which individuals' data was accessed, you must notify everyone whose information was in the compromised system. The Lucent breach affected approximately 37,000 individuals whose data resided in the compromised email account.
Phase 3: Notification Preparation (Days 16-30)
Draft your notification letters. Have legal counsel review for:
- Accuracy of incident description
- Completeness of required elements under 45 CFR § 164.404(c)
- Tone (factual, not defensive or minimizing)
- Clarity of action steps for individuals
Arrange credit monitoring or identity theft protection services before you notify. Offering services in your notification letter that aren't actually available yet creates additional liability.
Phase 4: Notification Execution (Days 31-60)
Send notifications and file required reports:
- Individual notifications via mail/email
- HHS Secretary notification through the HHS Breach Portal (for 500+ individuals)
- Media notification (for 500+ individuals in a state/jurisdiction)
- Business associate notifications if applicable
Maintain proof of mailing and delivery for your compliance documentation.
Common Pitfalls
Pitfall 1: Waiting for forensic certainty
You don't need absolute proof of data exfiltration to trigger notification obligations. The HITECH Act's presumption of breach means if unsecured PHI was accessible to an unauthorized person, you must notify unless your risk assessment demonstrates low probability of compromise. The 15-month delay in the Lucent case suggests the organization may have waited for investigative certainty that never came.
Pitfall 2: Confusing incident date with discovery date
Your 60-day clock starts when you discover or should have discovered the breach, not when the incident occurred. If you discover a six-month-old compromise today, your notification deadline is 60 days from today.
Pitfall 3: Incomplete risk assessments
Document all four factors explicitly. A risk assessment that only addresses "we found no evidence of exfiltration" without analyzing the other three factors won't satisfy HHS Office for Civil Rights (OCR) scrutiny.
Pitfall 4: Treating notification as a one-time event
Your obligations extend beyond the initial notification. You must:
- Respond to individual inquiries
- Provide updates if investigation reveals additional exposed data
- Maintain documentation for six years under 45 CFR § 164.530(j)
- Report the breach on your annual report if it affects fewer than 500 individuals
Pitfall 5: Underestimating settlement exposure
Even with no evidence of actual identity theft or fraud, breach notification failures create substantial settlement exposure. The Lucent settlement provides up to $550 for ordinary losses, $5,500 for extraordinary losses, plus $80 cash payments and three years of monitoring services per class member. Your exposure includes both actual damages and the cost of demonstrating compliance with notification requirements.
Quick Reference Table
| Requirement | Timeline | Citation | Key Action |
|---|---|---|---|
| Risk Assessment | Immediately upon discovery | 45 CFR § 164.402(2) | Document all four factors |
| Individual Notification | Within 60 days of discovery | 45 CFR § 164.404(a) | First-class mail or agreed email |
| HHS Secretary Notification (500+ individuals) | Concurrent with individual notice | 45 CFR § 164.408(a) | Submit via HHS Breach Portal |
| Media Notification (500+ in jurisdiction) | Concurrent with individual notice | 45 CFR § 164.406(a) | Contact prominent outlets |
| HHS Secretary Notification (<500 individuals) | Within 60 days of calendar year end | 45 CFR § 164.408(b) | Annual report submission |
| Business Associate Notification | Within 60 days of discovery | 45 CFR § 164.410 | If BA discovered the breach |
| Documentation Retention | Six years from creation or last effective date | 45 CFR § 164.530(j) | All assessments and notifications |
Your breach notification timeline starts the moment you discover unauthorized PHI access. The Lucent case demonstrates that a 15-month notification delay transforms a contained incident into class action litigation, regardless of the actual access window. Build your notification process before you need it, document your risk assessment thoroughly, and treat the 60-day requirement as a ceiling, not a target.
