Reading the HIPAA notification rule against the CISA and NIST control cadences to see why one is a ceiling and the others are intervals

What happened

What information mattered

• The regulation requires notification without unreasonable delay and in no case later than sixty calendar days after discovery of a breach [1].

• The sixty calendar day period runs from discovery and is an outer limit rather than a safe harbor, because the without unreasonable delay obligation runs alongside it [1].

• CISA Goal 1.C states that IR plans should be reviewed and drilled at a minimum annually, which is a floor rather than a target [2].

• The CISA goals are organized as GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER, aligning to the NIST Cybersecurity Framework version 2.0 [2].

• CISA Goal 2.C directs implementing a vulnerability management program to patch and mitigate misconfigured software in a timely manner, without naming a fixed interval [2].

• CISA Goal 3.D directs a defined and enforced administrative process to offboard staff including revocation of all access [2].

• The framework states PR.DS-11 as an outcome, that backups of data are created, protected, maintained, and tested, rather than as a schedule [3].

• The framework states PR.AT-01 as an outcome about personnel knowledge and skills rather than as a training frequency [3].

• The framework edition read here is CSF 2.0, published February 26, 2024 [3].

The insurance question

What was decided, and by whom

• No authority decided this. It is illustrative only. The notification requirement is quoted from the published text of the regulation as reproduced by the Legal Information Institute, and the control expectations from the published CISA Cross-Sector Cybersecurity Performance Goals Version 2.0 and the NIST Cybersecurity Framework 2.0, all read on 2026-08-31. Nothing here reflects a decision about any specific incident, organization, notification, or claim, and nothing here determines whether any event is a breach.

What cannot be generalized from this

• Whether any particular event is a breach requiring notification is a legal determination under the regulation and its exceptions, which were not read here. That question goes to a lawyer.

• The regulation read here governs protected health information under HIPAA. State breach notification statutes impose their own clocks and their own triggers, and none was read for this walkthrough.

• The regulation text was read on a third-party reproduction rather than on the publisher's own host. The wording may be identical; the guarantee is not. Confirm against the official text before relying on it.

• The CISA goals state in their own program materials that they are voluntary goals rather than requirements, so meeting or missing one is not by itself a compliance conclusion.

• Framework editions change. The framework read here is CSF 2.0 published February 26, 2024, and the CISA goals are Version 2.0 dated December 2025; verify the current editions before relying on any control identifier.

• Nothing here states what any cyber insurance policy covers, requires, or excludes. No policy or application form was read, and coverage is decided by the insurer under the policy actually issued.

Source ledger

3 sources. Every citation number above resolves to a record below. Nothing here sits behind an account.

1. [1]

   45 CFR 164.404 - Notification to individuals (HIPAA Breach Notification Rule)(opens the original record on Cornell Legal Information Institute, reproducing the Code of Federal Regulations)

   Cornell Legal Information Institute, reproducing the Code of Federal RegulationsSecondarySecondaryJurisdiction USThird-party reproductionPublished January 25, 2013Effective March 26, 2013Last checked August 31, 2026Updates: on-amendmentID cfr-45-164-404-lii

   What this source supports (2)

   • Paragraph (b), Implementation specification: Timeliness of notification, provides that a covered entity shall provide the notification required by paragraph (a) without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
   • The 60 calendar day period runs from discovery of the breach, and is an outer limit rather than a safe harbor, because notification must also be without unreasonable delay.

   ActiveReproduction
2. [2]

   Cross-Sector Cybersecurity Performance Goals, Version 2.0(opens the original record on Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security)

   Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland SecuritySecondaryPrimaryJurisdiction USPublished December 1, 2025Effective December 1, 2025Last checked August 31, 2026Updates: major-revisionID cisa-cpg-2-0

   What this source supports (23)

   • Cover page reads Cross-Sector Cybersecurity Performance Goals, Version 2.0, December 2025, Cybersecurity and Infrastructure Security Agency; marked TLP:CLEAR.
   • Contents are organized as 1. GOVERN, 2. IDENTIFY, 3. PROTECT, 4. DETECT, 5. RESPOND, 6. RECOVER, aligning to NIST Cybersecurity Framework version 2.0.
   • Goal 1.C MAINTAIN INCIDENT RESPONSE PLANS: organizations develop, maintain, update, and regularly exercise IR plans; IR plans should be reviewed and drilled, at a minimum, on an annual basis.
   • Goal 1.D SUPPLY CHAIN INCIDENT REPORTING AND VULNERABILITY DISCLOSURE addresses notifying a customer of security incidents and vulnerabilities within a risk-informed time frame.
   • Goal 2.C MITIGATE KNOWN VULNERABILITIES: implement a vulnerability management program to patch and mitigate misconfigured software in a timely manner, covering all organizational assets including those that face the internet.
   • Goal 3.D REVOKE CREDENTIALS FOR DEPARTING STAFF: a defined and enforced administrative process to offboard staff including revocation of all access; review user access and disable accounts when inactive for a specified period, for example 30 days.
   • Goal 3.F IMPLEMENT MULTIFACTOR AUTHENTICATION (MFA): organizations require MFA to access assets using the strongest available method; options sorted high to low are phishing-resistant MFA, then mobile app-based soft tokens, then SMS or voice only when no other options are possible; all IT accounts leverage MFA, prioritizing privileged administrative accounts.
   • Goal 3.H IMPLEMENT THE PRINCIPLES OF LEAST PRIVILEGE: user accounts do not have administrator privileges, administrators maintain separate user accounts for non-admin activity, and privileges are re-evaluated on a recurring basis to validate continued need.
   • Goal 3.J IMPLEMENT CYBERSECURITY TRAINING: new employees receive initial cybersecurity training prior to accessing computer systems, and at least annual cybersecurity training is provided for all organizational users covering recognizing social engineering, reporting suspicious activity, and basic cyber hygiene.
   • Goal 3.M ENABLE EMAIL SECURITY: on all corporate email infrastructure STARTTLS is enabled, SPF and DKIM are enabled, and DMARC is enabled and set to reject.
   • Goal 3.O MAINTAIN SYSTEM BACKUPS AND RESTORATION ABILITY: develop a list of all maintained backups including installation media, license keys, configuration information, and retention period; securely store backups offsite and offline; test backups and recovery on a recurring basis, no less than once per year; validate the integrity of backups before initiating restoration.
   • Goal 4.A ESTABLISH MALICIOUS CODE DETECTION: implement signature-based and non-signature-based mechanisms to detect and eradicate malicious code at system endpoints, organization-wide.
   • Goal 4.B IDENTIFY ADVERSE EVENTS: define clear criteria and processes for adverse events, and if an adverse event is suspected follow the protocol outlined in the incident response plan to escalate.
   • The CPGs are voluntary and strive to help small- and medium-sized organizations kickstart cybersecurity efforts by prioritizing a limited number of essential actions.
   • Goal 1.A ESTABLISH CYBERSECURITY RESPONSIBILITIES: roles, responsibilities, and authorities related to the organization's cybersecurity program are established, communicated, enforced, and aligned within the organization and external partners, and all roles and responsibilities involving cybersecurity should be documented in an organization's cybersecurity policy; scope reaches C-suite personnel, critical section leadership, physical and cybersecurity personnel, third-party contractors, vendors, and suppliers; NIST CSF 2.0 reference GV.RR-02.
   • Goal 1.B MANAGE CYBERSECURITY OVERSIGHT is a separate goal: policies for managing the cybersecurity program are reviewed at least annually, updated when changes are applied, communicated, and enforced; NIST CSF 2.0 reference GV.OV-03.
   • Goal 2.A MANAGE ORGANIZATIONAL ASSETS: maintain a regularly updated inventory of all organizational assets, meaning data, hardware, software, systems, facilities, and personnel, with IT and OT assets determined to be critical for business or operational functions updated on a more frequent basis.
   • Goal 3.K UTILIZE STRONG ENCRYPTION: use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications, and identify critical electronic file types and data to protect while in transit and at rest, which may include personally identifiable information and sensitive, proprietary or trade secret information.
   • Goal 2.B MITIGATE KNOWN VULNERABILITIES: implement a vulnerability management program to patch and mitigate misconfigured software in a timely manner, with a scope of all organizational assets, to include those that face the internet; monitor risk response progress through tools such as plan of action and milestones, risk registers, and risk detail reports; assign responsibilities and ensure procedures are followed. Goal 2.C is a different goal, OBTAIN INDEPENDENT VALIDATION OF CYBERSECURITY CONTROLS.
   • Goal 3.G ADMINISTRATORS MAINTAIN SEPARATE USER AND PRIVILEGED ACCOUNTS: user accounts do not have administrator privileges, administrators maintain separate user accounts for activities unrelated to their admin role, such as business email and web browsing, and privileges are re-evaluated on a recurring basis to validate continued need for a given set of permissions.
   • Goal 3.H IMPLEMENT THE PRINCIPLES OF LEAST PRIVILEGE: all user accounts, system roles, and processes operate with the minimum privileges necessary to perform their tasks, and quarterly reviews of access permissions and role assignments are performed to verify compliance with established policies.
   • Goal 3.L ENABLE EMAIL SECURITY: on all corporate email infrastructure (1) STARTTLS is enabled, (2) Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) are enabled, and (3) Domain-based Message Authentication, Reporting, and Conformance (DMARC) is enabled and set to reject; the stated outcome is reduced risk from spoofing, phishing, and interception. Goal 3.M is a different goal, DISABLE AUTORUN AND MACROS BY DEFAULT.
   • On small organizations the PDF says only that each organization faces unique cybersecurity challenges and that small- and medium-sized organizations may have limited budgets, staffing, and expertise; one of the stated criteria for a goal is that it be reasonably straightforward and not cost-prohibitive for small- and medium-sized entities to successfully implement. The voluntary and kickstart framing quoted in this module comes from the CISA program page, not from this PDF.

   Active
3. [3]

   The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)(opens the original record on National Institute of Standards and Technology, U.S. Department of Commerce)

   National Institute of Standards and Technology, U.S. Department of CommerceSecondaryPrimaryJurisdiction USPublished February 26, 2024Effective February 26, 2024Last checked August 31, 2026Updates: major-revisionID nist-csf-2-0

   What this source supports (15)

   • The current edition is CSF 2.0, published February 26, 2024, available free of charge at https://doi.org/10.6028/NIST.CSWP.29.
   • CSF 2.0 organizes outcomes under six Functions: GOVERN (GV), IDENTIFY (ID), PROTECT (PR), DETECT (DE), RESPOND (RS), RECOVER (RC).
   • PR.AA-03: Users, services, and hardware are authenticated.
   • PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.
   • PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.
   • PR.DS-11: Backups of data are created, protected, maintained, and tested.
   • PR.PS-02: Software is maintained, replaced, and removed commensurate with risk.
   • DE.CM-01: Networks and network services are monitored to find potentially adverse events.
   • RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared.
   • RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
   • GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities, and is communicated and enforced.
   • ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.
   • The CSF does not prescribe how outcomes should be achieved; it offers a taxonomy of high-level cybersecurity outcomes usable by any organization regardless of size, sector, or maturity.
   • PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected. PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected.
   • Cybersecurity Supply Chain Risk Management (GV.SC) is a category within the GOVERN function, covering cyber supply chain risk management processes identified, established, managed, monitored, and improved by organizational stakeholders.

   Active