HIPAA Breach Notification Letter Template

HIPAA-required notification document | Patient communication for data breaches | Legally-compliant template

Quick Answer

A Breach Notification Letter is the mandatory communication that healthcare organizations must send to patients when their Protected Health Information has been involved in a security incident. Required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D), this letter must describe the breach, inform patients of the types of information involved, explain steps they should take to protect themselves, and describe the organization's mitigation efforts. Time-sensitive and legally critical, this template ensures compliance with all required elements.

Understanding Breach Notification Requirements

When a security incident affects the confidentiality of unsecured Protected Health Information, you must notify affected patients without unreasonable delay and no later than 60 calendar days from discovery. The notification must include specific required content, use clear language, and be sent via a method that preserves confidentiality.

Required Notification Elements

HIPAA Breach Notification Letter Template

Copied to clipboard!
[ORGANIZATION NAME] [ADDRESS] [PHONE] [DATE] [PATIENT NAME] [PATIENT ADDRESS] [CITY, STATE ZIP] RE: NOTICE OF BREACH OF UNSECURED PROTECTED HEALTH INFORMATION Dear [PATIENT NAME]: We are writing to inform you of a security incident that may have affected the privacy of your health information. We take the privacy and security of your information very seriously, and we want to provide you with information about this incident, what we are doing about it, and the steps you can take to protect yourself. 1. WHAT HAPPENED On [DATE OF BREACH/DATE RANGE], we discovered that [DESCRIPTION OF INCIDENT]. [DESCRIBE HOW BREACH OCCURRED - e.g., "An employee inadvertently sent a patient list to an incorrect email address" or "Our billing system was accessed by unauthorized individuals due to a security vulnerability"]. We immediately initiated an investigation with the assistance of [FORENSIC FIRM/IT VENDOR if applicable] to determine the scope of the incident and whether any of your information was involved. 2. WHAT INFORMATION WAS INVOLVED Based on our investigation, we have determined that the following types of information about you may have been involved in this incident: [ ] Name and address [ ] Social Security number [ ] Date of birth [ ] Insurance information [ ] Medical record number [ ] Diagnosis and treatment information [ ] Prescription information [ ] Medical history [ ] Billing information [ ] Credit card or bank account information [ ] Other: [DESCRIBE] 3. WHAT WE HAVE DONE Upon discovery of this incident, we took the following steps: - Immediately secured our systems to prevent further unauthorized access - Launched a comprehensive investigation to determine what information was accessed - [If applicable] Notified law enforcement agencies - Implemented additional security controls to prevent similar incidents - [If applicable] Engaged external security experts to provide recommendations - Notified our workforce members about this incident and reinforced security protocols - Reviewed our security practices to identify areas for improvement We have found no evidence that your information has been used inappropriately or that your information is currently being misused. However, we understand that you are concerned about the security of your health information. 4. STEPS YOU SHOULD TAKE While we have no evidence that your information has been misused, we recommend that you take the following steps to protect yourself: Monitor Your Credit and Accounts: - Obtain free credit reports from www.annualcreditreport.com - Review credit reports for accounts you did not open - Place a fraud alert with the major credit bureaus if appropriate - Consider a credit freeze if you are concerned about identity theft Watch for Suspicious Communications: - Be cautious of unsolicited calls, emails, or letters requesting personal information - Report suspicious activity to the entity requesting information - Do not respond to requests for personal information via email Report Suspicious Activity: - If you notice any suspicious activity related to your accounts, contact your financial institution immediately - Report identity theft to the Federal Trade Commission at www.IdentityTheft.gov - File a report with local law enforcement if you believe you are a victim of identity theft Contact Us With Questions: - If you have questions about this incident or your health information, contact [NAME] at [PHONE] or [EMAIL] 5. IDENTITY MONITORING SERVICES [OPTIONAL - Include if offering identity monitoring services] At no cost to you, we are offering [DURATION]-months of complimentary credit monitoring and identity theft protection services through [PROVIDER]. These services include: - Credit monitoring and alerts - Identity theft insurance ($[AMOUNT] coverage) - Fraud recovery assistance - Dark web monitoring To enroll in these services, visit [WEBSITE] or call [PHONE NUMBER]. Your enrollment code is: [CODE] You must enroll by [DATE] to receive these services. 6. REGULATORY INFORMATION Under the HIPAA Breach Notification Rule, we are required to notify you of this incident. The Breach Notification Rule requires healthcare providers to implement safeguards to protect the privacy and security of health information. If you have concerns about our privacy practices, you may file a complaint with: U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201 Or submit a complaint online at: https://www.hhs.gov/hipaa/filing-a-complaint/index.html 7. MORE INFORMATION We deeply regret this incident and recognize the concern it may cause you. We remain committed to protecting the privacy and security of your health information. If you have questions about this incident, our security practices, or steps you can take to protect yourself, please contact: [CONTACT PERSON NAME] [TITLE] [ORGANIZATION NAME] [ADDRESS] [PHONE] [EMAIL] We are available to discuss this matter [HOURS OF AVAILABILITY]. Thank you for your patience and understanding as we work to resolve this matter and strengthen our security measures. Sincerely, [SIGNATURE] [NAME] [TITLE] [ORGANIZATION NAME] --- ENCLOSURES (if applicable): - Information about credit monitoring services - Information about fraud prevention and identity theft - Frequently asked questions about the incident

Customization Tips

Common Mistakes to Avoid

Frequently Asked Questions

How do I know if I need to send breach notification letters? +

You must send notifications if there is unauthorized access, acquisition, use, or disclosure of PHI AND there is a reasonable likelihood that the PHI has been compromised. If data was encrypted or the encryption key was not compromised, notification is typically not required.

What is the deadline for sending breach notifications? +

You must provide notification without unreasonable delay and no later than 60 calendar days from discovery of the breach. Calculate the timeline from when the breach was discovered, not when it occurred. Document your discovery date.

Do I need to notify the media? +

If the breach affects 500 or more residents in the same state or jurisdiction, you must notify media outlets. Contact major newspapers, radio stations, and television networks in the affected area without unreasonable delay and no later than 60 days from discovery.

Should I include a template for identity monitoring enrollment in the letter? +

Including information about identity monitoring services (if offered) is highly recommended and demonstrates your commitment to helping patients protect themselves. Clearly explain enrollment process, deadlines, and coverage details. This can reduce patient anxiety and litigation risk.

Prepare for Breach Response

Medcurity helps organizations develop comprehensive breach response procedures and notification templates.

Strengthen Your Breach Response