Description
Breach Notification Timeliness Tracker
HIPAA Breach Notification Rule — 45 CFR 164.404, 164.406, 164.408 | Editable Word Template
The HIPAA Breach Notification Rule sets specific deadlines for notifying affected individuals, the HHS Secretary, and in some cases the media. Missing any of those deadlines or failing to document when and how notifications were sent is itself a compliance failure, independent of the underlying breach. The Breach Notification Timeliness Tracker provides a structured tool for capturing every deadline, recording the status of each required notification, and maintaining the documentation that demonstrates compliance.
The tracker is designed to run alongside an active breach response, updated in real time as notifications are completed and confirmed. It is equally useful after the fact as a documentation record that ties together the notification history for a given incident and supports the six-year retention requirement under 45 CFR 164.414.
What Is Included
- Incident identification block linking the tracker to the corresponding breach file by case number and discovery date
- Individual notification section with deadline calculation fields based on discovery date, status tracking, method of delivery, and date completed including fields for tracking substitute notice where direct contact is not possible under 45 CFR 164.404(d)
- HHS Secretary notification section with separate deadline tracking for breaches affecting fewer than 500 individuals (annual reporting) and 500 or more (60-day immediate reporting) under 45 CFR 164.408
- Media notification section for tracking the 60-day deadline applicable to breaches affecting 500 or more individuals in a single state or jurisdiction under 45 CFR 164.406
- Business associate coordination fields for incidents originating with a BA where the covered entity is managing downstream notification
- Completion certification field with signature and date for the responsible privacy officer
- Instructions for use with a plain-language explanation of each notification deadline and how it is calculated
Who This Is For
Privacy officers, compliance officers, and practice administrators at covered entities who are responsible for managing breach notifications and maintaining the documentation required to demonstrate timely compliance. Particularly useful for organizations responding to a breach for the first time or for those who have previously managed notification tracking through informal methods and need a more reliable system.
Delivered as an editable Microsoft Word (.docx) file. Available immediately after purchase.
