Skip to content
DWT logo
People Services Insights
About Offices Careers
Search
People
Services
Insights
About
Offices
Careers
Search
Advisories
Technology + Privacy & Security

Calendar Year 2020 HIPAA Small Breach Notifications Due March 1, 2021

By Adam H. Greene, Rebecca L. Williams, Maryam Casbarro, and Lyra Correa
02.23.21
Share
Print this page

March 1, 2021, is the due date for HIPAA-covered entities to notify the U.S. Department of Health and Human Services Office for Civil Rights (OCR) about "small" breaches of unsecured protected health information discovered during calendar-year 2020. A small breach involves fewer than 500 individuals.

HIPAA Small Breach Notification Requirements

HIPAA requires covered entities to provide breach notification to affected individuals without unreasonable delay—and not later than 60 days after discovery. Covered entities also must report small breaches to OCR no later than 60 days after the end of the calendar year in which the small breaches were discovered. For calendar-year 2020, small breaches notifications are due on or before March 1, 2021.

Most business associates will not be affected by this deadline because their reporting obligation is to the covered entity and not to OCR, unless the covered entity has delegated its breach reporting obligations to the business associate.

How to Notify OCR

Covered entities should report each small breach separately online here.

OCR requires a separate report for each small breach, although we hope someday OCR will provide a means to report multiple small breaches to OCR through a single log or report.

Steps to Take for Notifications

In making these notifications, covered entities may consider:

  • Designating a person within the covered entity who will be responsible for the notifications and verifying the person's availability to make the notifications in a timely manner. (There have been situations when the Privacy Officer was vacationing at the time the notifications were due.)
  • Preparing the contents of the notification in advance. It may be helpful to have legal counsel or other appropriate people review the notification prior to submitting to OCR. Click here for a Davis Wright template outlining the breach notification questions for reporting through the OCR website.
  • Printing out and retaining a "receipt" of the filing of the notification or developing other documentation to demonstrate timely notification to OCR.
  • Verifying that the covered entity has appropriate documentation in place relating to the breach (including being able to demonstrate notification was sent without unreasonable delay and contained the required content).
  • Being prepared—notifications may spur investigations and compliance reviews from OCR.

If you need assistance reporting a breach, please contact our 24/7 Breach Response team at 844-GoToDWT (844-468-6398) to speak with a trained incident responder.

Related Articles

03.26.25
Webinars
Artificial Intelligence
"Evaluating AI Tools for Your Tax-Exempt Organization," AI Across Industries, Davis Wright Tremaine Webinar Read More
02.27.25
Webinars
Privacy & Security
"Securing Americans' Sensitive Data: Understanding the DOJ's New Final Rule," Davis Wright Tremaine Webinar Read More
02.26.25
Webinars
Artificial Intelligence
"Foundations of AI: What Tax-Exempt Organizations Need to Know," AI Across Industries, Davis Wright Tremaine Webinar Read More
DWT logo
©1996-2025 Davis Wright Tremaine LLP. ALL RIGHTS RESERVED. Attorney Advertising. Not intended as legal advice. Prior results do not guarantee a similar outcome.
Media Kit Affiliations Legal notices
Privacy policy Employees DWT Collaborate EEO

SUBSCRIBE
©1996-2025 Davis Wright Tremaine LLP. ALL RIGHTS RESERVED. Attorney Advertising. Not intended as legal advice. Prior results do not guarantee a similar outcome.