> ## Documentation Index
> Fetch the complete documentation index at: https://docs.imaracare.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Breach notifications

> Track HIPAA § 164.404 PHI breach incidents and 60-day HHS notification deadlines.

**Breach Notifications** is an Administrator-only tab found under **Settings → Breach Notifications**. It helps your facility track potential protected health information (PHI) breaches and meet the HIPAA Breach Notification Rule (45 CFR § 164.400–414).

<Warning>
  Track every potential breach here — even if your risk assessment later concludes no notification is required. The record demonstrates due diligence.
</Warning>

## The 60-day rule

Under HIPAA § 164.404, when a breach is discovered, covered entities must notify:

* **Affected individuals** — without unreasonable delay, and no later than 60 days after discovery
* **HHS** — within 60 days (or annually for breaches affecting fewer than 500 individuals)

ImaraCare calculates the deadline automatically from the discovery date you enter.

## Record a breach incident

<Steps>
  <Step title="Open Breach Notifications">
    Go to **Settings → Breach Notifications**.
  </Step>

  <Step title="Click New Incident">
    Click the **New Incident** button in the top right.
  </Step>

  <Step title="Fill in the form">
    Complete the required fields — see the table below.
  </Step>

  <Step title="Save">
    The 60-day notification deadline is set automatically from the discovery date.
  </Step>
</Steps>

## Incident fields

| Field                     | Notes                                                                                       |
| ------------------------- | ------------------------------------------------------------------------------------------- |
| **Discovery date & time** | When you first became aware of the breach                                                   |
| **Description**           | What happened, how it was discovered, and initial scope                                     |
| **Affected residents**    | Count of individuals whose PHI may have been exposed                                        |
| **Data types exposed**    | Check all that apply: diagnosis, medications, SSN, DOB, contact info, financial, other ePHI |
| **Encrypted**             | Whether the data was encrypted at the time of the incident                                  |
| **Unauthorized access**   | Whether unauthorized access is likely                                                       |
| **Status**                | Investigating → Covered Entity Notified → HHS Notified → Closed                             |
| **Resolution notes**      | Risk assessment findings, notification steps taken, outcome                                 |

## Status meanings

| Status                      | When to use                                                     |
| --------------------------- | --------------------------------------------------------------- |
| **Investigating**           | Breach discovered; risk assessment underway                     |
| **Covered Entity Notified** | Affected individuals have been notified                         |
| **HHS Notified**            | HHS notification submitted                                      |
| **Closed**                  | Risk assessment ruled out breach, or all notifications complete |

## Deadline badges

Each open incident shows a countdown badge next to the status:

* **Overdue** — 60-day window has passed
* **N days left** — deadline is within 14 days (red) or more than 14 days (grey)
* No badge shown when status is **HHS Notified** or **Closed**

<Note>
  ImaraCare tracks deadlines and statuses but does not submit notifications to HHS on your behalf. Use the [HHS Breach Portal](https://ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf) for official reporting.
</Note>

See also [HIPAA compliance](/administration/hipaa-compliance) for the full picture of HIPAA obligations in ImaraCare.