Timeliness of Notification

§164.404(b)
Timeliness of Notifications.
Except as provided in §164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

Audit Inquiry

§164.404(b)
Timeliness of Notifications
Were individuals notified of breaches within the required time period? Inquire of management.

Obtain and review the policies and procedures for notifying individuals of breaches and determine whether such policies and procedures are consistent with §164.404(b); providing notification without unreasonable delay and in no case later than within 60 days of discovery of a breach.

Obtain and review documentation related to breaches, if any, in the specified period, to include evidence of the date individuals were notified, the date the covered entity discovered the breach, and the reason, if any, for delay in notification. Assess whether the notifications were completed in accordance with these requirements and the entity’s policies and procedures.