"Sometimes an investigation takes months to complete, and the HIPAA deadline for providing notice may have passed before a health plan or health care provider even knows who was affected by the breach and is entitled to notice. Plan administrators ... need to consider how and when they can provide appropriate notice to individuals ... taking into account HIPAA's requirements, the terms of the applicable business associate agreement, concerns about causing undue alarm, and other factors."  MORE >>