# HHS Defines Breach Reporting Window

HHS’s HIPAA breach-notification framework gives a business associate up to 60 days after discovering a breach to notify the covered entity, while the Business Associate Agreement (BAA) may require notice sooner. For procurement, vendor-management, and incident-response teams, the 60-day limit should not be treated as the contractual deadline or an operational target: organizations need to know the notice period in each applicable BAA before an incident occurs.

- Covered entities and contractors handling protected health information should confirm that BAAs are executed and identify the breach-notification timeline in each agreement.
- Procurement and vendor-management teams can record BAA notice deadlines alongside vendor and contract information so incident responders can find the applicable terms promptly.
- Organizations should align vendor escalation and incident-response procedures with the contractual notice periods, which may be shorter than the HIPAA outer limit.

**Jurisdictions:** federal
**Industries:** Healthcare
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 24, 2026

### Government Entities
- U.S. Department of Health and Human Services (HHS)

### Sources
- [HHS allows a vendor up to 60 days after discovering a breach to tell you. Your BAA sets the actual window, and each one can differ. No BAA, no agreed window. The middle of a breach is not the time to go looking for the contract. https://t.co/8s3nH8C8XE](https://x.com/jvjinfinity/status/2114024939544088732) - twitter-agency