DDSIntelThe Transition Layer
MenuClose
  1. Home
  2. By audience
  3. What are the HIPAA breach reporting rules after a practice ownership change?

What are the HIPAA breach reporting rules after a practice ownership change?

Under HIPAA, as firms that serve dental practices must know, individuals must be notified of a breach without unreasonable delay and no later than 60 calendar days after discovery, and breaches of 500 or more people are reported to HHS at the same time. HIPAA Journal counted 710 such large breaches on the HHS portal in 2025.

By DDSIntel Editorial· Published · Data as of

Key numbers

What is the deadline to notify individuals of a breach?

The HIPAA rule requires covered entities to notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. Sixty days is the outer limit, not a target. A practice that changes owner should know who is responsible for the notice if a breach is discovered near closing.

See the IT and MSP hub and IT during a sale.

When are breaches reported to HHS?

For breaches affecting 500 or more individuals, notice to the HHS Secretary goes out contemporaneously with the notice to individuals. For breaches affecting fewer than 500, the covered entity must report no later than 60 days after the end of each calendar year. Counsel should confirm the process for a given incident.

How common are large breaches?

HIPAA Journal counted 710 healthcare data breaches of 500 or more records on the HHS Office for Civil Rights portal in 2025, and said 35.8% occurred at business associates. These figures cover all healthcare, not only dentistry, and the portal keeps adding reports after the year ends.

The count is a floor that can rise as the portal updates. Ownership changes tracked as transition signals are the moments when responsibility for this data moves.

Who is responsible if a breach is found after a sale?

It depends on the agreement, on who the covered entity is at the time of discovery, and on when the breach occurred. The purchase agreement should allocate responsibility, cost and notification duties. See purchase agreement clauses. This is general information, so consult counsel.

National practice counts are on the data hub and in how many dentists are in the U.S..

Frequently asked questions

Does HIPAA apply to every dental practice?

It applies to covered entities, which include health care providers that conduct certain electronic transactions. Confirm with counsel.

Are IT vendors covered?

Vendors that handle protected information for a covered entity are business associates, and the covered entity needs satisfactory assurances they will safeguard it.

Is the 2025 count final?

No. The portal adds reports after the year ends, so the count can rise.

Where are breaches posted?

HHS publishes breaches of 500 or more individuals on the OCR breach portal.

Sources

  1. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.404, Notification to individuals. law.cornell.edu.
  2. U.S. Department of Health and Human Services (via Cornell Legal Information Institute). 45 CFR 164.408, Notification to the Secretary. law.cornell.edu.
  3. HIPAA Journal, from the HHS Office for Civil Rights breach portal. 2025 healthcare data breach report. hipaajournal.com.
  4. ADA Health Policy Institute. The U.S. Dentist Workforce, 2025 update. ada.org.

Questions or corrections: request a correction. Markdown version: /for/dental-practice-breach-trends.md.