A breach starts a clock, several of them, and the Breach Notification Rule is strict about every one. Breach Tracking is the workflow — four-factor analysis, 60-day clock, notification matrix, documentation — so the week after an incident is work, not panic.
What it does
- Runs the four-factor analysis per §164.402, capturing each factor’s finding and rationale.
- Tracks the 60-day clock from discovery and surfaces the delta between discovery and determination.
- Builds the notification matrix: individuals, HHS, media (500+), state AGs — with state-specific overlays.
- Preserves the full incident file for OCR response and insurer notification.
How it maps to HIPAA
The workflow operationalises §164.400 through §164.414 (the Breach Notification Rule), with cross-links to §164.308(a)(6) security incident procedures and the §164.502(e) BA notification obligations when the breach originates upstream.
Where it fits
Breach Tracking is part of the Privacy module. When a determined breach escalates, the Incident Response Assistance service runs it with you; the plain-language background is the HIPAA Incident Response guide.