45 CFR 164.402 presumes every unauthorized use or disclosure of unsecured PHI is a breach unless a four-factor risk assessment demonstrates a low probability the information was compromised. Most incidents a practice logs never clear that bar: a misdirected export retrieved and deleted the same night. The mistake runs both directions. Treating everything as reportable burns weeks on letters nobody owed; treating nothing as reportable until it obviously is misses the window, because the clock in 164.404(a)(2) starts at discovery, not when the investigation ends.
Discovery, and then two separate counts. 164.406(a) requires media notice only in a state where more than 500 of its own residents were affected. 164.408(b) requires Secretary notice, on the same 60-day clock as individual notice, once the total across every state reaches 500, no matter how thin the split. A breach can clear the second test while clearing the first in no state at all, and a checklist that only asks 'over 500?' as one question, not two, is the one gap in every generic breach-response template we read.
Wexford Family Medicine, a fictional three-state practice, logged three incidents this year. One, fourteen records retrieved within hours, never cleared the four-factor test and needed no notice at all. One, a phished scheduling mailbox, affected 512 patients across Ohio, Kentucky and Indiana, 261/178/73, none of which tops 500. Secretary notice was owed by April 3; no state got a media notice. One, a stolen laptop, put 540 Ohio patients over that state's own threshold, triggering both. Same aggregate math, two different outcomes.
HIPAA Breach Notification Response Template