Delayed Notification of Cyberattacks May Trigger HIPAA Breach Notification Rule

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

On July 29, OCR announced a resolution agreement and corrective action plan with the health system. The agreement sends a clear signal to all covered entities and business associates that they must notify HHS of a breach within 60 days of its discovery, not after a forensic investigation is completed.

This client alert provides a refresher on the applicable law and OCR guidance governing breach notification timing. It also highlights prior OCR enforcement actions and offers practical recommendations for reviewing and updating your organization's internal policies and procedures.

Background

On April 23, 2021, OSF Healthcare discovered that the "Nephilim" ransomware variant had infiltrated its systems, prompting an internal forensic investigation. Four months later, on August 24, investigators concluded that the PHI of 53,907 individuals had been stolen. OSF did not notify affected individuals or HHS until October 1, 2021.

Among other violations, OCR determined OSF violated two core provisions of the HIPAA Breach Notification Rule:

• Failure to notify affected individuals within 60 calendar days of discovery of the breach.
• Failure to notify HHS within 60 calendar days of discovery (required for breaches affecting 500 or more individuals, contemporaneously with individual notice).

The health system agreed to pay a $552,250 settlement to OCR and implement a corrective action plan (CAP) that requires it to revise breach notification policies and train employees on HIPAA rules. OCR will monitor the health system for two years under the agreement.

Once a Breach Is Detected, the HIPAA Clock Starts Ticking

The 60-day-notification clock starts on the day a breach, or a suspected breach, is detected. If, by the 60th day after discovery, a covered entity has not yet determined the full scope of the breach, it should notify OCR with its findings to that point. Additional information can be provided as it becomes available. Similarly, affected individuals should be notified no more than 60 days after the discovery of a breach.

A covered entity might be allowed to delay notification if a law enforcement official requests a delay on the grounds that notification would impede a criminal investigation. However, this exception is narrow. The request must be specifically documented, and the permissible delay is limited in duration. The existence of an ongoing criminal investigation — without a documented, specific law enforcement request — does not justify any delay.

Lessons Learned From Past OCT Enforcement Actions

The OSF Healthcare System case is OCR’s 21st ransomware enforcement action. As part of its broader cyber investigation and risk-analysis initiative, OCR has increasingly scrutinized the timeliness of breach notifications when investigating ransomware and other cyberattack-related breaches. OCR's October 2022 Cybersecurity Newsletter and subsequent enforcement actions have consistently reinforced that delayed notification — even where the entity is engaged in a good-faith forensic investigation — will be viewed as a compliance failure. Despite delays in the HIPAA Security Rule updates, timely notifications remain an OCR enforcement focus. 

Here is a look at other cases that involved a delayed breach notification or at-risk PHI:

• Presence Health (2017): The health system paid a $475,000 settlement after it notified affected individuals 101 days after discovering PHI records had been breached. Presence Health became aware that the documents were missing on October 22, 2013, but OCR was not notified until January 31, 2014 — more than a month after the 60-day HIPAA Breach Notification Rule deadline. OCR described this as the first enforcement action focused specifically on notification timeliness.
• Solara Medical Supplies (2022): OCR settled following a phishing attack affecting 114,000+ individuals, citing failures to timely notify both individuals, media, and HHS within the required 60-day period.
• Vision Upright MRI (2025): Vision Upright paid $5,000 to OCR and agreed to a two-year corrective action plan after it suffered a data breach involving unauthorized access to a server, which exposed the medical images of 21,778 individuals. The company failed to notify affected individuals within 60 days of discovery of the breach, according to OCR.
• MMG Fusion (2026): In March 2023, OCR initiated an investigation into a possible breach. The investigation concluded that an unauthorized actor gained access to MMG’s information system and impermissibly accessed PHI of approximately 15 million individuals. The company had not notified covered entities of the breach. The settlement resulted in a corrective action plan that OCR said it would monitor for three years. The CAP required MMG to develop, maintain, and revise its written policies and procedures to comply with the Privacy and Security Rules. The company was also fined $10,000.

10 Steps to Strengthen Breach Notification Policies

Given the OSF Healthcare settlement, and OCR's consistent enforcement posture, we urge covered entities and business associates to conduct a careful review of their HIPAA breach notification policies and procedures. Consider the following steps:

1. Ensure internal documents include the definition of “discovery.” According to OCR, a security breach is "discovered" on the first day the incident is known to the entity (or should reasonably have been known), not after a forensic investigation or final-impact report has been completed. The 60-day notification clock begins on the day a breach is discovered.
2. Review the incident response plan (IRP). An IRP should establish a clear internal timeline from the discovery of a breach, through risk assessment, breach determination, and notification. The IRP should include explicit milestones. Predetermined milestones at days 30 and 45, for example, can be used to assess notification readiness. Designate specific personnel responsible for tracking all milestones and response deadlines.
3. Establish risk-assessment procedures: Any impermissible use or disclosure of unsecured PHI is presumed to be a breach. To overcome this presumption and avoid mandatory notification, a covered entity or business associate must conduct a documented risk assessment proving a low probability that the PHI has been compromised. If the assessment cannot be completed before the 60-day deadline, policies should permit notification to proceed on the basis of available information. The time period for breach notification begins when the incident is first known, not when the investigation of the incident is complete, even if it is initially unclear whether the incident constitutes a breach as defined in HIPAA.
4. Review all business associate agreements (BAAs). Under HIPAA, covered entities are generally required to execute agreements with their business associates to ensure the appropriate safeguarding of protected health information. These agreements must address compliance with the Security Rule's requirements and obligate the business associate to report any breaches of unsecured PHI to the covered entity. In addition, covered entities should conduct sufficient due diligence to confirm that their business associates have adequate risk assessment policies and procedures in place. BAAs should require prompt notification by business associates (ideally within 24–48 hours of discovery) to the covered entity of a breach of unsecured PHI. Review or establish procedures for receiving these reports and, if warranted, trigger the covered entity's internal breach response process.
5. Include procedures for law-enforcement delays. Law enforcement might ask a covered entity to delay notification during an ongoing investigation. But the existence of an investigation does not automatically justify a delay. Policies should include processes for documenting any delay request, determining the permissible duration of any delay, and monitoring the request's status.
6. Write breach notifications in plain language. Readability is important. Notifications sent to affected people should also include a description of the incident, relevant dates, the types of PHI involved, protective steps the user can take, mitigation actions the covered entity has taken, and contact procedures.
7. Conduct workforce training. OCR has consistently looked to workforce training as a corrective action in breach notification settlements. Proactive training is seen as both a compliance requirement and a mitigating factor in the event of an investigation. It should emphasize the 60-day-notification clock, internal reporting obligations, and the consequences of delayed notification under HIPAA. Training should be conducted regularly and documented.
8. Ensure policies address ransomware specifically. Per OCR's 2016 Ransomware and HIPAA Fact Sheet, a ransomware attack typically constitutes a security incident under HIPAA unless the covered entity can demonstrate a low probability that PHI was compromised. The burden of proof rests with the covered entity. Upon detection of a ransomware attack, personnel should immediately initiate the breach response process, including recording the discovery date, without waiting for forensic confirmation.
9. Maintain thorough documentation. All breach-related activities should be documented. This includes the date and circumstances of discovery, the breach-risk assessment and outcome, all notification efforts (i.e., dates, methods, and recipients), any law enforcement delay requests and their basis, and any supplemental notifications. Thorough documentation is essential for demonstrating HIPAA compliance and defending the organization in an OCR investigation.
10. Conduct periodic tabletop exercises. Use these exercises to identify gaps in timelines, escalation procedures, and decision-making authority, and update policies and IRPs accordingly. Tabletops can help pressure-test breach notification processes, including ransomware scenarios with ongoing forensic investigations.

 What to Watch

The OCR's settlement with OSF Healthcare System is a reminder that HIPAA's 60-day breach notification clock starts ticking on the day a breach is discovered. Covered entities and business associates should use this settlement as an opportunity to revisit breach notification policies, incident response plans, BAA notification provisions, and workforce training programs to confirm alignment with these obligations. Our team at Crowell & Moring is available to assist with policy reviews, training, and incident response planning.