CFR > Title 45 - Public Welfare > SUBTITLE A—DEPARTMENT OF HEALTH AND HUMAN SERVICES > SUBCHAPTER C—ADMINISTRATIVE DATA STANDARDS AND RELATED REQUIREMENTS (parts 160 to 165) > PART 164—SECURITY AND PRIVACY > SUBPART D—Notification in the Case of Breach of Unsecured Protected Health Information (§164.400 to §164.414) > 164.406—Notification to the media.

164.406—Notification to the media.

(a) Standard. For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in § 164.404(a)(2), notify prominent media outlets serving the State or jurisdiction. For purposes of this section, State includes American Samoa and the Northern Mariana Islands.
(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
(c) Implementation specifications: Content of notification. The notification required by paragraph (a) of this section shall meet the requirements of § 164.404(c).