1. Introduction

Breach notification timelines for health data are the legal deadlines within which hospitals, healthcare providers, laboratories, insurers, digital health platforms, and other regulated organisations must report unauthorised access, disclosure, loss, alteration, or theft of health information.

Health data is especially sensitive because it can expose a person's diagnoses, genetic information, mental health history, prescriptions, reproductive health information, insurance details, and identity.

The law generally addresses three questions:

When must the organisation notify the affected individual?

When must it report the breach to a regulator or government authority?

What consequences follow if notification is late, incomplete, or omitted?

There is no single worldwide deadline. The applicable period depends on the jurisdiction, the type of organisation, the data involved, and the circumstances of the breach.

For an India-focused analysis, the main legal frameworks include the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and applicable CERT-In directions. Comparative analysis also draws on the United States' HIPAA framework and the EU and UK GDPR regimes.

2. Major breach notification deadlines compared

6 hours

India — CERT-In

Certain reportable cyber incidents

CERT-In's directions require covered cyber incidents, including data breaches and data leaks, to be reported within six hours of noticing them or being brought to notice. Whether a particular health-data incident falls within the reporting categories must be assessed.

72 hours

India / EU / UK

Regulatory reporting

Under Rule 7 of India's DPDP Rules, 2025, detailed information to the Data Protection Board of India is generally due within 72 hours of awareness, subject to a permitted extension. Under GDPR Article 33, qualifying breaches must generally be reported to the supervisory authority within 72 hours of awareness.

60 days

United States

HIPAA outer deadline

Covered entities generally must notify affected individuals of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery.

These periods are not interchangeable. A single incident may trigger more than one obligation, and the shortest applicable deadline may require action before a longer deadline expires.

HHS.gov+4

3. Indian legal framework

A. Digital Personal Data Protection Act, 2023 and Rules, 2025

India's DPDP Rules introduce a specific breach notification framework through Rule 7.

Under the rule as notified, a data fiduciary must:

Notify each affected individual without delay after becoming aware of a personal data breach.

Notify the Data Protection Board of India without delay.

Submit updated and detailed information to the Board within 72 hours, unless a longer period is permitted by the Board.

The notification to individuals should explain the nature, extent and timing of the breach, likely consequences, mitigation measures, precautions individuals can take, and contact details for further enquiries.

Official Government Version+1

Important commencement qualification: As of 29 October 2026, the substantive DPDP provisions and Rule 7 are scheduled to commence 18 months after publication of the relevant November 2025 Gazette notifications, namely in May 2027. They should not be treated as already operative merely because the Act and Rules have been enacted and notified.

IndiaCode+2

Consequently, an Indian hospital assessing a breach today must distinguish future DPDP obligations from requirements already in force.

B. Information Technology Act, 2000 and SPDI Rules, 2011

Before the relevant DPDP provisions commence, the existing framework remains important.

Section 43A of the Information Technology Act, 2000, historically provided compensation where a body corporate handling sensitive personal data was negligent in maintaining reasonable security practices and thereby caused wrongful loss or gain. The Sensitive Personal Data or Information Rules, 2011 include health conditions, medical records and medical history within sensitive personal information.

However, these provisions do not create a universal, express 72-hour health-data breach notification deadline comparable to GDPR Article 33.

The commencement and repeal provisions of the DPDP Act must also be checked when determining which statutory remedies remain available for a particular incident.

IndiaCode+2

C. CERT-In Directions, 2022

CERT-In's directions require specified cyber incidents to be reported within six hours of noticing them or being brought to the organisation's notice.

This obligation can be relevant to healthcare organisations experiencing incidents such as:

Ransomware attacks against hospital systems.

Unauthorised access to electronic medical records.

Data leaks and exfiltration.

Certain incidents affecting hospital networks and digital health infrastructure.

The six-hour obligation is a cyber-incident reporting requirement, not a substitute for notifying affected patients under any separately applicable privacy law. Organisations should assess the incident against CERT-In's prescribed categories and reporting instructions.

Wadhwa Law Offices+1

4. United States: HIPAA breach notification deadlines

The United States' Health Insurance Portability and Accountability Act (HIPAA) Breach Notification Rule, 45 C.F.R. §§ 164.400–414, is a major example of a health-sector-specific notification regime.

HIPAA deadline matrix

Affected individuals

60 days

Maximum from discovery; without unreasonable delay.

HHS Secretary: 500 or more people

60 days

Maximum from discovery.

HHS Secretary: fewer than 500 people

Annual reporting

Within 60 days after the end of the calendar year of discovery.

Prominent media outlets

60 days

Required if more than 500 residents of a state or jurisdiction are affected.

These deadlines apply to covered entities and their relevant obligations under HIPAA. Business associates must notify the covered entity without unreasonable delay and no later than 60 days after discovery under the federal rule; contracts may require faster reporting.

HHS.gov+2

What counts as a breach?

Generally, an impermissible use or disclosure of unsecured protected health information is presumed to be a breach unless the organisation establishes an applicable exception or demonstrates, through the required risk assessment, a low probability that the information was compromised.

Relevant factors include the type and sensitivity of information, who received or accessed it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. Encryption can affect whether the information qualifies as unsecured protected health information under applicable guidance.

A breach involving diagnoses, HIV status, psychiatric records or genetic data may create especially serious risks, although the applicable legal test must still be applied to the facts.

HHS.gov+1

5. European Union and United Kingdom: GDPR

Under EU GDPR Articles 33 and 34, health data is a special category of personal data, subject to heightened protection.

The 72-hour deadline is not an automatic requirement to notify every patient. It applies to reporting qualifying breaches to the supervisory authority; individual notification has a separate risk-based threshold.

For example, accidental disclosure of a patient's identifiable psychiatric records to an unauthorised recipient may require prompt assessment of both regulatory reporting and direct notification. A properly encrypted device lost without the possibility of unauthorised decryption may lead to a different result.

ICO+1

6. Important case laws

The following judgments and enforcement proceedings help explain how courts and regulators approach health-data confidentiality, security failures, notification duties, and the harm caused by delayed or inadequate responses.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

India — Constitutional privacy

Court: Supreme Court of India, nine-judge bench.

Facts and issue: The litigation concerned whether privacy is protected as a fundamental right under the Indian Constitution.

Judgment: The Court recognised privacy as a constitutionally protected fundamental right, grounded principally in Article 21 and other constitutional freedoms. It emphasised dignity, autonomy and protection against unjustified intrusions into personal life.

Relevance to health-data notification: The case did not establish a specific deadline for notifying patients after a data breach. Nevertheless, its constitutional reasoning supports the importance of protecting sensitive personal information and ensuring that intrusions into privacy are legally justified and adequately safeguarded.

Sci API+1

Legal principle: Health-data confidentiality is connected to personal autonomy and dignity; breach notification deadlines, however, must be found in applicable legislation and regulations.

Case 2: Curry v. AvMed, Inc. (2012), 11th Cir.

Citation: 693 F.3d 1317 (11th Cir. 2012).

Facts: Two unencrypted laptops containing the sensitive information of approximately 1.2 million current and former health-plan members were stolen. The information included identifying details and medical information. Plaintiffs alleged that their information was subsequently used in identity theft.

Decision: The Eleventh Circuit reversed the district court's dismissal of the relevant claims, concluding that the plaintiffs' allegations of actual identity theft and associated injury were sufficient at the pleading stage.

Relevance: The case illustrates how inadequate security for health information can lead to consequential personal harm and litigation. It is relevant to evaluating breach response, risk assessment and the potential need for protective measures following exposure.

Limitation: The decision did not create a general statutory breach-notification deadline. HIPAA's applicable regulatory deadlines must be analysed separately.

Justia Law+1

Case 3: LabMD, Inc. v. Federal Trade Commission (2018)

Court: United States Court of Appeals for the Eleventh Circuit.

Facts: The FTC challenged the medical testing laboratory's security practices after sensitive consumer information was exposed through peer-to-peer file-sharing software.

Decision: The appellate court set aside the FTC's order on administrative-law grounds concerning the specificity and enforceability of the order. The case did not establish that healthcare organisations may disregard data-security duties.

Relevance: The proceedings illustrate the importance of legally grounded, sufficiently specific regulatory requirements when authorities seek to compel corrective action following a health-data exposure.

The underlying FTC proceeding also resulted in a 2016 Commission decision finding unreasonable security practices and ordering remedial measures, including consumer notification. That administrative history must be distinguished from the subsequent appellate decision.

Federal Trade Commission+1

Legal principle: Regulatory enforcement depends on the governing statute, the evidentiary record and the legal validity of the remedy sought; a data breach does not automatically establish every alleged violation.

Case 4: FTC v. LabMD, Inc. (FTC administrative proceeding, 2016)

Authority: Federal Trade Commission.

Facts: Medical and financial information relating to consumers was exposed through deficient security controls.

Finding: The FTC concluded that LabMD's security practices were unreasonable and that exposure of sensitive information could constitute substantial consumer injury. The Commission ordered the company to implement a comprehensive information-security programme and notify affected consumers.

Relevance: The proceeding shows why a breach response must consider both technical remediation and communications with affected people. It also demonstrates that inadequate security may create regulatory exposure independently of a separate dispute about notification timing.

Federal Trade Commission+1

Important distinction: This was an FTC administrative enforcement matter, not a judicial ruling that established a universal deadline for health-data notification.

7. How courts and regulators assess late notification

Although the precise legal test differs between jurisdictions, five factors commonly matter.

Awareness and discovery: When did the organisation have sufficient facts to recognise that a reportable breach had occurred? The date an attack began may differ from the date the organisation discovered it.

Reason for delay: Did the organisation need to establish the affected systems, individuals or data categories? Investigation may justify staged reporting where permitted, but it does not automatically suspend a statutory deadline.

Sensitivity and scale: Exposure of psychiatric records, genetic information, reproductive-health records or large volumes of medical data may heighten the risk of harm.

Protective action: Prompt containment, credential resets, forensic investigation, patient guidance and appropriate notification can reduce harm, though they do not erase a missed deadline.

Evidence of compliance: Incident logs, decision records, copies of notices, regulator submissions and communications with service providers help demonstrate what happened and when.

A useful distinction is between a security failure, a failure to notify, and a failure to notify within the required period. They can overlap, but they are not legally identical.

8. What should a healthcare organisation do after discovering a breach?

A practical response should begin immediately rather than waiting for the full investigation to conclude.

Illustrative incident-response sequence

Immediately — contain the incident

Isolate compromised systems where appropriate, preserve evidence, secure accounts and escalate the incident internally.

First hours — establish reporting obligations

Determine whether CERT-In reporting, sector-specific requirements or other immediate legal duties apply. Record the time of discovery and escalation.

Within the earliest applicable deadline — report

Submit required preliminary reports and make notifications to individuals or regulators as the applicable law requires. Do not assume that a later deadline overrides an earlier one.

During the investigation — update

Establish the affected population, data types, likely consequences, mitigation measures and whether further notification is required.

After containment — document and improve

Preserve the incident timeline, evaluate the cause, remediate vulnerabilities and retain records for the applicable period.

9. Illustrative legal problem

Hypothetical: An Indian hospital discovers on 1 October that an attacker accessed 20,000 electronic patient records. The hospital confirms that diagnoses, prescriptions and contact details were exposed. It waits three weeks before notifying anyone because its forensic investigation is incomplete.

The legal analysis would ask:

Did the incident fall within a CERT-In reporting category requiring notification within six hours?

What other currently operative sectoral or contractual duties applied?

Was there an independent obligation to notify patients under the law applicable on the incident date?

If Rule 7 of the DPDP Rules applies at the relevant future date, were the required notifications made without delay and the detailed Board report provided within 72 hours, or within a permitted extension?

Did the delay increase patient harm or compromise the organisation's ability to demonstrate compliance?

Conclusion: An incomplete forensic investigation is not, by itself, a universal legal justification for delaying notification. The organisation must identify each applicable duty, meet the relevant deadline, and provide supplementary information when legally permitted or required.

10. Conclusion

Breach notification timelines for health data are a central part of healthcare privacy governance. The applicable deadline depends on the jurisdiction and the nature of the incident.

The principal comparisons are:

India: Certain reportable cyber incidents may trigger CERT-In's six-hour reporting requirement. The DPDP Rules' detailed breach notification regime is scheduled for commencement in May 2027, rather than being generally operative as of 29 October 2026.

United States: HIPAA generally requires individual notification without unreasonable delay and no later than 60 days after discovery.

EU and UK: GDPR-style rules generally use a 72-hour regulatory reporting deadline for qualifying breaches, with a separate risk-based standard for notifying individuals.

Case law: Puttaswamy, Curry v. AvMed and the LabMD proceedings illustrate the importance of privacy, security, evidence of harm and legally valid enforcement, but none should be mischaracterised as establishing one universal notification deadline.

For a legal memorandum, compliance policy or examination answer, the strongest approach is to identify the governing jurisdiction first, distinguish enacted rules from provisions in force, and then apply the relevant deadline to the facts.

A useful next step would be to prepare a jurisdiction-wise case-law table with exact citations, statutory provisions, notification deadlines and the legal principles established by each authority.