Per the HIPAA Breach Notification Rule, organizations that discovered a HIPAA breach in 2018 that affected fewer than 500 people have until March 1 to report the breach to the Office for Civil Rights. Organizations with more than one breach are required to complete a report for each incident. READ MORE