A HIPAA compliance letter is a signed statement in which an organization confirms how it protects protected health information (PHI). No federal regulation requires a general one, and no government body issues one. Yet it is one of the most requested documents in healthcare procurement, and one of the most common reasons a health tech deal stalls in security review.
The confusion starts with the name. “HIPAA compliance letter” covers at least seven different documents, from a vendor attestation sent to a hospital’s procurement team to a breach notice mailed to 40,000 patients. Some are optional business documents. Others, like breach notification letters, carry hard legal deadlines and mandatory content under the HIPAA Breach Notification Rule, with civil monetary penalties behind them.
This guide covers each type, what to include, how to write one that survives legal and procurement review, five templates you can adapt, and the documentation that has to sit behind the letter for it to mean anything.
What Is a HIPAA Compliance Letter?
A HIPAA compliance letter is a formal written statement from a covered entity or business associate that describes its compliance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. It identifies who is making the claim, which PHI it covers, which safeguards are in place, and who is accountable. An authorized officer, usually the designated Privacy Officer, Security Officer, or a senior executive, signs it.
Purpose of a HIPAA Compliance Letter
The letter does one job: it puts an accountable name behind a compliance claim. Hospitals, health plans, and digital health companies cannot audit every vendor that touches their data, so they ask vendors to state their position in writing. A signed letter creates a record of what was represented. That record matters a great deal if a breach later reveals the representation was false.
What the letter cannot do is prove compliance. The U.S. Department of Health and Human Services (HHS) does not certify organizations for HIPAA, and it does not recognize private “HIPAA certifications” either. Compliance shows up in the program behind the letter: a current risk assessment, written policies, workforce training, signed Business Associate Agreements (BAAs), and the ability to withstand an investigation by the Office for Civil Rights (OCR).
Important: Never write “HIPAA certified” in a compliance letter. There is no official HIPAA certification, and experienced procurement reviewers read the phrase as a sign that the sender does not understand the regulation. Write “compliant with the applicable requirements of the HIPAA Privacy, Security, and Breach Notification Rules” instead.
When a HIPAA Compliance Letter Is Required
Most HIPAA compliance letters are contractually required, not legally required. The most common trigger is vendor onboarding: a health system’s security team sends a questionnaire, and somewhere in it sits a request for a signed HIPAA attestation. Contract renewals, RFPs, and annual vendor risk reviews produce the same request.
The legal requirement kicks in when something goes wrong. A breach of unsecured PHI obligates written notice to every affected individual within strict deadlines. An OCR complaint or compliance review calls for a formal written response, usually prepared with counsel. And employers that sponsor group health plans must provide a specific written certification before the plan can share PHI with them, which we cover below.
Who Sends and Receives HIPAA Compliance Letters
HIPAA regulates two kinds of organizations. Covered entities are health plans, health care clearinghouses, and health care providers that conduct standard transactions electronically. Business associates are organizations that create, receive, maintain, or transmit PHI on a covered entity’s behalf: SaaS platforms, billing companies, cloud hosts, managed service providers, transcription services, and consultants. Since the 2013 Omnibus Rule, business associates and their subcontractors are directly liable for Security Rule compliance, not just contractually bound.
In practice, letters flow up and down that chain. Business associates send attestations to the covered entities they serve, and subcontractors send them to the business associates above them. Covered entities send breach notices and privacy communications to patients, and both covered entities and business associates send response letters to OCR when a complaint or investigation lands.
Insider Note: The vendors who stop fighting letter requests are the ones who stop treating them as one-offs. In a recent HIPAA engagement, an AI company deploying conversational agents for healthcare customers went from gap analysis to a documented HIPAA program, including a formal risk assessment and controls mapped to the Security Rule, in a few weeks. The step that changed its sales cycle came after: publishing that program through a trust center. Now, when a hospital asks for a compliance letter, the team sends a link instead of trading documents and security questionnaires back and forth, and conversations with healthcare buyers move noticeably faster.
Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.
Schedule Your Free Assessment Today
Types of HIPAA Compliance Letters
Seven letters fall under the “HIPAA compliance letter” label. Only two are mandated by regulation; the rest are business documents whose content and tone you control. Knowing which one you are writing decides how much legal review it needs.
| Letter type | Typical sender | Typical recipient | Legally required? |
|---|---|---|---|
| Attestation letter | Covered entity or business associate | Customers, partners, auditors | No (contractual) |
| Compliance verification letter | Vendor, or a customer requesting one | Covered entity or vendor | No (contractual) |
| Breach notification letter | Covered entity | Affected individuals | Yes, 45 CFR 164.404 |
| Violation response letter | Covered entity or business associate | OCR or the complainant | Effectively yes, once OCR asks |
| Letter to patients | Covered entity | Patients | Depends on purpose |
| Business associate letter | Business associate or subcontractor | Covered entity or upstream BA | No, but BAA terms often require reporting |
| Employer and health plan letter | Plan sponsor (employer) | Group health plan | Yes, plan sponsor certification |
HIPAA Attestation Letter
An attestation letter is a self-declaration: the organization states that it has implemented the safeguards HIPAA requires and that a named officer stands behind that statement. It is the most common type and the one most vendors mean when they say “HIPAA letter.”
There is a stronger version. Some organizations engage an independent CPA firm to examine their HIPAA controls and issue a third-party attestation report under AICPA attestation standards. That report carries far more weight with enterprise buyers than a self-signed letter, because someone outside the company tested the claims. Many health tech companies pair it with, or map it onto, a SOC 2 report so one audit cycle answers both questions.
HIPAA Compliance Verification Letter (for Vendors and Partners)
A verification letter runs in two directions. A covered entity may send one to a vendor asking it to confirm specific practices, such as encryption of ePHI at rest and in transit, breach reporting timelines, and subcontractor flow-down. The vendor’s reply, signed by an officer, becomes part of the covered entity’s vendor risk file.
The value here is specificity. A verification letter that answers concrete questions (“Is ePHI encrypted with AES-256 at rest?”) is more useful to both sides than a general attestation, and harder to sign carelessly.
HIPAA Breach Notification Letter
This is the one letter with detailed federal rules attached. When a covered entity discovers a breach of unsecured PHI, it must notify each affected individual in writing, without unreasonable delay and no later than 60 calendar days after discovery. The regulation dictates the content, the delivery method, and the backup options when contact details are missing. We break down every requirement in its own section below.
HIPAA Violation Response Letter
A violation response letter answers an allegation, whether it comes from a patient complaint, an employee report, or an OCR data request. Its job is to show the regulator that you investigated, identified the root cause, mitigated any harm, and changed something so it does not recur. OCR’s investigators read these letters looking for evidence of a functioning compliance program, not apologies.
This letter should never go out without counsel’s review. Every factual statement in it can become part of the enforcement record, and admissions are hard to walk back.
HIPAA Compliance Letter to Patients
Covered entities write to patients for several reasons: confirming how their information is protected after they ask, announcing a material change to the Notice of Privacy Practices (NPP), or responding to a privacy complaint filed through the organization’s internal process. The NPP itself is a separate required document; the letter explains or accompanies it.
Plain language is the whole game here. A patient letter that reads like a contract generates more phone calls, not fewer.
HIPAA Compliance Letter for Business Associates
Business associates write to covered entities to confirm they meet their obligations under the BAA: safeguarding PHI, reporting incidents, flowing requirements down to subcontractors, and returning or destroying PHI at contract end. Subcontractors send the same letter up the chain to the business associate that engaged them.
This letter does not replace the BAA. It confirms that the obligations the BAA created are being met in practice.
HIPAA Compliance Letter for Employers and Health Plans
Employers are not covered entities when acting as employers, but their group health plans are. Before a group health plan can disclose PHI to the employer that sponsors it, the employer must certify in writing that the plan documents have been amended to restrict how it uses that PHI, including a promise not to use it for employment decisions. This plan sponsor certification is a genuine regulatory requirement, and benefits teams often encounter it as “the HIPAA letter” from their broker or third-party administrator.
Key Elements to Include in a HIPAA Compliance Letter
A credible compliance letter is specific enough to be checked. Every element below exists so the recipient can verify a claim, hold someone accountable for it, or know when it expires.
Organization and Contact Information
Start with the full legal name of the entity, its address, and whether it acts as a covered entity, a business associate, or both. Include a named contact for follow-up questions, ideally the Privacy or Security Officer rather than a sales address. Procurement teams route follow-ups to whoever is listed, and a generic inbox slows the whole review.
Statement of HIPAA Compliance
This is the core sentence, and its wording matters more than anything else in the letter. State that the organization has implemented policies, procedures, and safeguards designed to comply with the applicable requirements of the Privacy, Security, and Breach Notification Rules, as amended by the HITECH Act and the Omnibus Rule. Avoid absolute language like “fully compliant at all times” or “guarantees the security of all data.” No organization can honestly guarantee either, and absolute claims become liabilities after an incident.
Scope of Protected Health Information (PHI) Covered
Define what the letter covers: which products, services, systems, and locations handle PHI, and what types of PHI they process. A telehealth platform might list appointment records, clinical notes, and payment information processed through its video and scheduling products. Scope protects you as much as the recipient, because a claim limited to named systems cannot be stretched to cover an acquired subsidiary you have not yet integrated.
Reference to Safeguards (Administrative, Physical, Technical)
The Security Rule organizes its requirements into three categories, and a good letter names representative controls from each.
- Administrative safeguards include the risk analysis, risk management plan, sanctions policy, workforce training, and contingency planning.
- Physical safeguards cover facility access, workstation security, and device and media controls.
- Technical safeguards cover access controls, audit logging, integrity controls, transmission security, and encryption.
- You do not need to list every implementation specification. Three to five concrete controls per category, described plainly, signal a working program better than a page of regulatory citations.
Policies, Procedures, and Training Attestations
Confirm that written policies exist and are reviewed on a defined schedule, that workforce members complete HIPAA training at onboarding and at least annually, and that you apply the minimum necessary standard to uses and disclosures of PHI. If you hold relevant third-party assessments, such as a SOC 2 Type II report, ISO 27001 certification, or HITRUST certification, reference them here and offer them under NDA.
Signature of Privacy or Compliance Officer
An authorized officer signs, with printed name, title, and date. HIPAA requires covered entities to designate a Privacy Official and requires both covered entities and business associates to designate a Security Official, so these are the natural signatories. A letter signed by an account executive tells the recipient nobody with compliance authority reviewed it.
Effective Date and Review Period
Give the letter an effective date and a validity window, typically 12 months, and commit to notifying the recipient of material changes before then. Compliance is a moving state. A letter with no date is still circulating three years later, describing a security program that may no longer exist.
How to Write a HIPAA Compliance Letter (Step-by-Step)
Drafting the letter takes an hour. Making it true can take weeks, which is why the order of these steps matters.
Step 1: Identify the Recipient and Purpose
Read the request closely before you write anything. A hospital asking for “evidence of HIPAA compliance” may accept a signed attestation, or it may want your risk analysis summary, your BAA, and a SOC 2 report. Ask the requester what format they accept and whether they have their own template, because many health systems do and will reject anything else.
The purpose also decides the tone. An attestation to a customer is confident and concise. A response to OCR is factual and cautious. A breach notice to patients is plain, direct, and focused on what the reader should do next.
Step 2: State Your Compliance Position Clearly
Write one sentence that states your position, then support it. Before you sign that sentence, check it against reality: do you have a documented, current risk analysis? Written policies? Training records for every workforce member? Signed BAAs with every subcontractor that touches PHI?
If any answer is no, fix the gap before you send the letter, or narrow the claim to what is true. A HIPAA gap analysis is the fastest way to find out where you stand before you put an officer’s name on the page.
Pro Tip: Keep a one-page evidence map
Keep a one-page evidence map behind every attestation letter: each claim in the letter, the policy or control that supports it, and where the evidence lives. When the follow-up questionnaire arrives, you answer it in a day instead of a fortnight.
Step 3: Reference Specific HIPAA Rules (Privacy, Security, Breach Notification)
Name the rules your organization complies with and the parts of HIPAA that actually apply to you. A pure infrastructure vendor with no patient relationship has limited Privacy Rule obligations but full Security Rule obligations. Saying so shows you understand your role. Claiming blanket compliance with rules that do not apply suggests you copied a template.
Reference the regulation as it stands today. HHS published a proposed overhaul of the Security Rule in the Federal Register on January 6, 2025, but it remains unfinalized, and HHS’s updated regulatory agenda now projects final action no earlier than July 2027. Your letter should cite the current rule, not proposed requirements.
Step 4: Include Supporting Documentation or Attachments
A letter alone rarely closes a security review. Offer, or attach, the documents that back it up: a summary of your most recent risk analysis, your policy index, training completion rates, a list of subprocessors with BAAs in place, and any third-party reports. Share sensitive material under NDA through a secure portal rather than as email attachments.
Step 5: Review and Sign by an Authorized Officer
Have the Privacy or Security Officer review every factual statement, and have legal counsel review any letter going to a regulator, a large enterprise customer, or affected individuals. Then the authorized officer signs and dates it. Record who signed, when, and what they reviewed, because that record becomes part of your compliance documentation.
HIPAA Compliance Letter Templates
The templates below are starting points, not legal advice. Replace every bracketed field, delete any claim you cannot support with evidence, and have counsel review anything going to a regulator or to affected individuals.
Template: General HIPAA Compliance Attestation Letter
[Organization Letterhead]
[Date]
[Recipient Name]
[Title]
[Organization]
[Address]
Re: HIPAA Compliance Attestation
Dear [Recipient Name],
[Organization Legal Name] (“[Short Name]”) operates as a [covered entity / business associate] under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act and the 2013 Omnibus Rule.
This letter confirms that [Short Name] has implemented policies, procedures, and safeguards designed to comply with the applicable requirements of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule with respect to the protected health information (PHI) it creates, receives, maintains, or transmits through [products, services, or systems in scope].
Our compliance program includes:
1. A documented enterprise risk analysis, most recently completed on [date], and an associated risk management plan.
2. Administrative safeguards, including a designated Privacy Officer and Security Officer, a sanctions policy, and HIPAA training for all workforce members at onboarding and annually.
3. Physical safeguards, including controlled facility access, workstation security, and device and media disposal procedures.
4. Technical safeguards, including role-based access controls, multi-factor authentication, audit logging, and encryption of electronic PHI in transit and at rest.
5. Breach notification and incident response procedures consistent with 45 CFR 164.400-414.
6. Business Associate Agreements with all subcontractors that access PHI on our behalf.
[Optional: [Short Name] also maintains [SOC 2 Type II report / ISO 27001 certification / HITRUST certification], available under NDA on request.]
This attestation is effective as of [date] and is valid for twelve (12) months. We will notify you of any material change to our compliance program during that period.
For questions, please contact [Name], [Title], at [email] or [phone].
Sincerely,
[Signature]
[Printed Name]
[Title: Privacy Officer / Security Officer / CEO]
[Organization]
Template: Vendor/Business Associate HIPAA Compliance Letter
[Business Associate Letterhead]
[Date]
[Covered Entity Contact Name]
[Title]
[Covered Entity Name]
[Address]
Re: Business Associate HIPAA Compliance Confirmation
Dear [Contact Name],
[Business Associate Name] provides [description of services] to [Covered Entity Name] under the Business Associate Agreement dated [BAA date] (the “BAA”).
As a business associate, we confirm that we:
1. Use and disclose PHI only as permitted by the BAA and the HIPAA Rules, and limit access to the minimum necessary to perform our services.
2. Comply with the HIPAA Security Rule, including administrative, physical, and technical safeguards for electronic PHI.
3. Will report any use or disclosure of PHI not provided for by the BAA, including breaches of unsecured PHI, to [Covered Entity Name] within [number] days of discovery, and in no case later than 60 calendar days, as required by 45 CFR 164.410.
4. Require any subcontractor that creates, receives, maintains, or transmits PHI on our behalf to agree in writing to the same restrictions and conditions.
5. Will make PHI available for access, amendment, and accounting of disclosures as required under the BAA.
6. Will return or destroy all PHI at termination of our services, where feasible.
Our current subcontractors with access to PHI are listed in Attachment A.
This confirmation is effective as of [date]. Please direct questions to [Name], [Title], at [email].
Sincerely,
[Signature]
[Printed Name]
[Title]
[Business Associate Name]
Template: Breach Notification Letter to Affected Individuals
[Covered Entity Letterhead]
[Date]
[Individual Name]
[Mailing Address]
Notice of Data Breach
Dear [Individual Name],
We are writing to tell you about an incident that involved some of your health information, what we are doing about it, and steps you can take to protect yourself.
What happened: On [date of breach], [brief, plain-language description of what happened]. We discovered the incident on [date of discovery].
What information was involved: The information involved may have included your [list types of PHI, for example: name, address, date of birth, Social Security number, health insurance information, diagnosis, treatment information].
What we are doing: [Describe investigation, containment, and mitigation steps, for example: we secured the affected system, engaged an independent forensic firm, notified law enforcement, and strengthened access controls.]
What you can do: [Specific protective steps, for example: review statements from your health insurer and providers, enroll in the complimentary credit monitoring described below, place a fraud alert with credit bureaus.]
[Optional: We are offering [number] months of complimentary credit monitoring and identity protection through [provider]. To enroll, visit [URL] and use code [code] by [deadline].]
For more information: Call our dedicated toll-free line at [toll-free number], [hours], email [email address], or write to [postal address].
We sincerely regret this incident and any concern it may cause you.
Sincerely,
[Signature]
[Printed Name]
[Title]
[Covered Entity Name]
Template: HIPAA Compliance Letter to Patients
[Practice or Organization Letterhead]
[Date]
[Patient Name]
[Mailing Address]
Re: How We Protect Your Health Information
Dear [Patient Name],
Thank you for your question about how [Organization Name] protects your health information.
We follow the federal privacy and security rules under HIPAA. In practical terms, that means:
1. Only staff who need your information to care for you, bill for your care, or run our operations can access it.
2. We store electronic records in secure systems that require individual logins and keep a record of who accessed them.
3. Our staff complete privacy and security training every year.
4. Companies that work for us and handle your information, such as our billing service, must sign contracts promising to protect it.
You have rights over your health information, including the right to see and get a copy of your records, to ask us to correct them, and to receive a list of certain disclosures we have made. Our Notice of Privacy Practices, enclosed, explains these rights in full.
If you have questions or concerns, please contact our Privacy Officer, [Name], at [phone] or [email]. You may also file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.
Sincerely,
[Signature]
[Printed Name]
[Privacy Officer]
[Organization Name]
Template: Response Letter to a HIPAA Complaint or Investigation
[Organization Letterhead]
[Date]
[Investigator Name]
Office for Civil Rights
U.S. Department of Health and Human Services
[Regional Office Address]
Re: OCR Transaction Number [number]
Dear [Investigator Name],
[Organization Name] submits this response to your letter dated [date] regarding the complaint filed by [complainant, if named] concerning [brief description of allegation].
1. Background: [Describe the organization, its role under HIPAA, and the relevant department or system.]
2. Investigation: Upon receiving [the complaint / your letter], our Privacy Officer opened an internal investigation on [date]. We [describe steps: interviewed workforce members, reviewed audit logs, examined relevant policies].
3. Findings: [State what the investigation found, factually and without speculation.]
4. Corrective actions: [Describe actions taken, for example: sanctioned the workforce member under our sanctions policy, revised the relevant procedure, retrained the department on [date], implemented a technical control.]
5. Supporting documentation: Enclosed are [list: relevant policies, training records, risk analysis excerpts, audit log summaries, sanctions documentation].
[Organization Name] takes its obligations under HIPAA seriously and will cooperate fully with your review. Please direct further correspondence to [Name], [Title], at [email] and [phone].
Sincerely,
[Signature]
[Printed Name]
[Title]
[Organization Name]
Reviewed by counsel: [Counsel name, firm]
Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.
Schedule Your Free Assessment Today
Sample HIPAA Compliance Letter (Full Example)
Here is the attestation template filled in for a fictional remote patient monitoring company selling to a hospital system. Notice how specific it is: named systems, a dated risk analysis, a stated breach reporting window, and an expiry date. Every claim can be checked.
Brightwell Care Analytics, Inc.
410 Harbor Street, Suite 300, Boston, MA 02110
March 3, 2026
Dana Ortiz
Director of Vendor Risk Management
Lakeside Regional Health System
1200 Medical Center Drive, Hartford, CT 06106
Re: HIPAA Compliance Attestation for the Brightwell RPM Platform
Dear Ms. Ortiz,
Brightwell Care Analytics, Inc. (“Brightwell”) acts as a business associate to Lakeside Regional Health System under the Business Associate Agreement dated January 15, 2026.
Brightwell has implemented policies, procedures, and safeguards designed to comply with the applicable requirements of the HIPAA Security Rule, the Breach Notification Rule, and the Privacy Rule provisions that apply to business associates. This attestation covers the Brightwell RPM Platform, including its clinician dashboard, patient mobile application, and device data ingestion service, all hosted in our production environment on a U.S.-region cloud infrastructure provider with which we hold a signed BAA.
PHI in scope includes patient demographics, device readings (blood pressure, glucose, weight, pulse oximetry), care team notes, and alert history.
Our program includes:
1. An enterprise risk analysis completed on November 18, 2025, with a risk management plan reviewed quarterly by our Security Officer.
2. A designated Privacy Officer and Security Officer, a documented sanctions policy, and HIPAA training completed by 100% of workforce members within 30 days of hire and annually thereafter.
3. Role-based access with single sign-on and multi-factor authentication for all workforce access to production systems, with access reviews every quarter.
4. AES-256 encryption of ePHI at rest and TLS 1.2 or higher in transit.
5. Centralized audit logging of all access to ePHI, retained for at least one year and monitored for anomalous activity.
6. A tested incident response plan. Brightwell will notify Lakeside of any breach of unsecured PHI within 10 calendar days of discovery, as set out in our BAA.
7. BAAs with all four subcontractors that access PHI, listed in Attachment A.
Brightwell also holds a SOC 2 Type II report covering the period June 1 to November 30, 2025, available under our mutual NDA.
This attestation is effective March 3, 2026, and is valid through March 2, 2027. We will notify you in writing of any material change to these safeguards before that date.
Please direct questions to Marcus Lee, Security Officer, at security@brightwellcare.example or (617) 555-0142.
Sincerely,
[Signature]
Priya Raman
Chief Privacy Officer
Brightwell Care Analytics, Inc.
Attachment A: Subcontractors with access to PHI
Worth Knowing: The 10-day breach reporting window
The 10-day breach reporting window in this example is contractual, not regulatory. HIPAA allows business associates up to 60 calendar days to notify a covered entity, but most hospital BAAs now set a far shorter window. Make sure the number in your letter matches the number in your BAA, because reviewers check.
Common Mistakes to Avoid in a HIPAA Compliance Letter
Most rejected letters fail for the same four reasons. None of them is about formatting.
Vague Compliance Claims
“We take security seriously and are fully HIPAA compliant” tells a reviewer nothing. It names no safeguards, no scope, no date, and no evidence. Worse, an unqualified claim of full compliance gives a plaintiff’s lawyer an easy exhibit if a breach later shows otherwise. Replace adjectives with facts: what you encrypt, how you control access, when you last assessed risk.
Missing Breach Notification Timelines
Covered entities want to know how fast you will tell them when something goes wrong, because their own 60-day clock to notify patients can start when you discover the breach. A letter that promises “prompt notification” without a number leaves them guessing. State a specific window, make sure it matches your BAA, and make sure your incident response process can actually meet it.
Omitting Business Associate References
Your subcontractors are part of your compliance posture. A letter that says nothing about the cloud host, the support desk tool, or the analytics provider that touches PHI suggests either that no BAAs exist or that nobody checked. Name your subprocessors, or attach a list, and confirm that each has signed a BAA with flow-down terms.
Lack of Officer Authorization
A letter signed by a sales lead, or not signed at all, will not satisfy a serious reviewer. The signatory should hold real authority over the compliance program, typically the designated Privacy or Security Officer. If those roles are not formally designated in writing, that is itself a Security Rule gap to fix before you sign anything.
The most damaging version of this mistake is attesting to a risk analysis you have not done. OCR has named an inadequate or missing risk analysis as one of the most frequent Security Rule failures in its enforcement actions for years. If the letter mentions one, have the document dated and on file before you send it.
HIPAA Breach Notification Letter Requirements
The HIPAA Breach Notification Rule, 45 CFR 164.400-414, is the one place where HHS dictates what a letter must say, when it must arrive, and how it must be delivered. It applies only to breaches of unsecured PHI, meaning PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction meeting HHS guidance. That is the strongest practical argument for encrypting ePHI everywhere: properly encrypted data with an uncompromised key generally does not trigger notification at all.
Covered entities and business associates carry the burden of proof. If you decide an incident was not a reportable breach, you must be able to show why, usually through a documented four-factor risk assessment covering the nature of the PHI, who received it, whether it was actually viewed or acquired, and how far the risk was mitigated.
Timing Requirements (60-Day Rule)
The clock starts on the day of discovery, meaning the first day the breach is known, or by exercising reasonable diligence would have been known, to anyone in the workforce other than the person who committed it. Sixty days is a ceiling, not a target: the standard is “without unreasonable delay.” OCR has reached settlements with organizations specifically over untimely breach notification, so a notice sent on day 59 for a breach you understood on day 10 is a risk, not a safe harbor.
| Who must be notified | Deadline | When it applies |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 calendar days after discovery | Every breach of unsecured PHI |
| HHS Secretary (OCR) | Within 60 days of discovery | Breach affecting 500 or more individuals |
| HHS Secretary (OCR) | Within 60 days after the end of the calendar year | Breach affecting fewer than 500 individuals (annual log) |
| Prominent media outlets | Without unreasonable delay, no later than 60 days after discovery | More than 500 residents of one state or jurisdiction |
| Covered entity (notified by business associate) | Without unreasonable delay, no later than 60 days after discovery, or sooner per the BAA | Breach at or by a business associate |
Law enforcement can pause the clock. If an official states that notification would impede a criminal investigation or harm national security, the covered entity must delay notice for the period specified in writing, or up to 30 days on an oral statement that it documents.
Required Content Under the HHS Breach Notification Rule
The notice to individuals must be written in plain language and must include five elements:
- A brief description of what happened, including the date of the breach and the date of discovery, if known.
- The types of unsecured PHI involved, such as name, Social Security number, date of birth, diagnosis, or account numbers.
- The steps individuals should take to protect themselves from potential harm.
- A brief description of what the covered entity is doing to investigate, mitigate harm, and prevent recurrence.
- Contact procedures for questions, which must include a toll-free telephone number, an email address, a website, or a postal address.
State breach laws often add requirements on top, such as credit monitoring offers, regulator contact details, or specific headings. When a breach spans several states, draft to the strictest combination.
Delivery Methods and Recordkeeping
Written notice goes by first-class mail to the individual’s last known address, or by email if the individual has agreed to electronic notice. If the individual is deceased, notice goes to the next of kin or personal representative where the address is known. Where there is possible imminent misuse, you may also call affected individuals, in addition to the written notice.
When contact information is missing or out of date, the rule requires substitute notice. For fewer than 10 individuals, an alternative written notice, a phone call, or other means will do. For 10 or more, you must either post a conspicuous notice on your website homepage for 90 days or run a notice in major print or broadcast media in the affected area, and keep a toll-free number active for at least 90 days.
Keep copies of every notice, the mailing list, returned mail logs, substitute notice evidence, your risk assessment, and the HHS submission confirmation. If OCR asks whether you notified everyone on time, that file is your entire answer.
How to Deliver and Document a HIPAA Compliance Letter
A compliance letter is itself compliance documentation. How you send it, store it, and track it determines whether it helps you in an audit or simply exists.
Secure Delivery Methods
Attestation and verification letters rarely contain PHI, so standard business channels are usually fine: a signed PDF by email, an e-signature platform, or your customer’s vendor risk portal. Supporting documents are different. Risk analysis summaries, network diagrams, and audit reports describe your defenses in detail, so share them through an access-controlled data room or trust portal, under NDA, with access logging.
Letters that do contain PHI, such as breach notices or patient correspondence, follow the delivery rules above: first-class mail by default, email only with the individual’s prior agreement, and encrypted transmission whenever ePHI travels electronically.
Retention Requirements (6-Year Rule)
HIPAA requires covered entities and business associates to retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later, under 45 CFR 164.316(b)(2) for the Security Rule and 45 CFR 164.530(j) for the Privacy Rule. That covers attestation letters you issue, breach notices and their supporting records, complaint responses, and the BAAs they reference.
The “last in effect” wording trips people up. An attestation valid until March 2027 must be kept until March 2033, not six years from the day you signed it. State medical records laws, customer contracts, and litigation holds can stretch retention further; we cover how these overlap in our guide to SOC 2 and HIPAA evidence retention.
Tracking Acknowledgments
For every letter you send, log who received it, when, and whether they acknowledged it. For breach notices, the log is required evidence. For attestations, it tells you which customers to notify when your program materially changes and which letters are about to expire.
A simple register is enough:
| Field | Example |
|---|---|
| Letter type | Attestation |
| Recipient | Lakeside Regional Health System, Vendor Risk |
| Date sent | 2026-03-03 |
| Signed by | Chief Privacy Officer |
| Valid until | 2027-03-02 |
| Acknowledged | Yes, by email, 2026-03-05 |
| Supporting documents shared | SOC 2 Type II report, subcontractor list |
| Retain until | 2033-03-02 |
Conclusion
A HIPAA compliance letter is only as strong as the program behind it. The template is the easy part. The risk analysis, written policies, training records, BAAs, and incident response process are what turn a signature into a defensible claim, and they are what a hospital’s security team asks for next.
For most health tech vendors, the letter request is the first sign that HIPAA has become a revenue issue. Axipro’s HIPAA compliance services take companies from gap analysis to a documented, audit-ready program in as little as six weeks, so the letter you sign describes controls that exist. For teams that want that program run for them on an ongoing basis, our Compliance as a Service keeps the evidence current long after the first deal closes.
