When Millstone Medical Outsourcing detected suspicious activity on December 16, 2025, it launched an investigation. Nine months later, in September 2026, it disclosed a breach affecting Social Security numbers, government IDs, financial account codes, and health records. This timeline raises a question every covered entity faces when a Business Associate gets compromised: do you notify patients the moment you suspect a breach, or wait until you know exactly what happened?
The Question at Hand
The Breach Notification Rule requires notification "without unreasonable delay and in no case later than 60 calendar days" after discovery. But "discovery" is tricky when a vendor breach unfolds over months. If your Business Associate tells you on January 15 that it detected an intrusion in December but hasn't confirmed whether Protected Health Information (PHI) was accessed, does the clock start on January 15? Or when the forensic report lands in July confirming PHI exposure?
This isn't just theoretical. According to research cited in Applied Clinical Informatics, 56.4% of healthcare delivery organizations reported a breach involving a third party accessing their network in the last 12 months. Your vendor's investigation timeline directly affects your notification obligations, and practitioners argue both sides.
The Case for Early Disclosure
Some compliance officers advocate for immediate notification the moment you learn of a potential breach at a vendor, even before forensic confirmation.
Their argument: the Breach Notification Rule's 60-day clock starts when you knew or "reasonably should have known" of a breach. If your Business Associate tells you unauthorized access occurred in its environment holding your patients' ePHI, you reasonably should know a breach happened. Waiting for the vendor to complete a multi-month investigation doesn't pause that clock.
Early disclosure also protects patient trust. If you notify patients in January that a vendor incident may have exposed their data, then update them in July with specifics, you've been transparent. If you stay silent until July and patients learn you knew in January, the delay looks like concealment.
The practical approach: treat vendor notification of suspicious activity as triggering your own breach assessment. Document your reasoning if you conclude no breach occurred, but if you can't rule out PHI access within days, start your notification process. You can always provide updates as the investigation progresses.
The Case for Waiting for Confirmation
Other compliance teams argue you shouldn't trigger breach notification until forensic analysis confirms PHI was actually accessed or acquired.
Their reasoning: the Breach Notification Rule applies to breaches of "unsecured Protected Health Information." If your vendor's investigation ultimately shows the intruder never reached the file share containing your patients' records, or accessed only encrypted data, no breach occurred. Notifying patients prematurely creates unnecessary alarm, erodes confidence in your security, and wastes resources on call centers and credit monitoring you didn't need to provide.
The regulation supports some delay for investigation. Office for Civil Rights (OCR) guidance acknowledges that determining whether a breach occurred may require forensic analysis. The question is how long "reasonable" investigation takes.
The practical concern: if you notify in January based on incomplete information, then discover in July that the breach was smaller than feared, you've already spent the credit monitoring budget and damaged patient confidence. If you wait for certainty and OCR later decides you should have known sooner, you face penalties for late notification.
Where Practitioners Actually Land
Most covered entities take a middle path: they start their own breach risk assessment immediately when a vendor reports suspicious activity, but don't trigger patient notification until they have enough facts to meet the Breach Notification Rule's content requirements.
The regulation requires your notice to include a description of what happened, the types of information involved, steps individuals should take, what you're doing to investigate and prevent recurrence, and contact information. If your vendor tells you in December it detected an intrusion but can't yet confirm what data the intruder accessed, you can't write that notice.
The compromise: document your assessment process in real time. If your Business Associate detected suspicious activity on December 16, your risk assessment should begin that week. Press the vendor for weekly updates. Set internal deadlines: if we don't have confirmation within 30 days, we notify based on worst-case assumptions. If the vendor provides evidence within that window that no PHI was accessed, document why you concluded no breach occurred.
This approach keeps you within the 60-day window from when you reasonably should have known, while giving you enough facts to write a meaningful notice.
Our Take
You can't wait nine months for certainty. The Millstone Medical timeline, suspicious activity detected December 16, 2025, investigation confirming PHI exposure on July 15, 2026, public disclosure in September 2026, stretches the Breach Notification Rule past any reasonable interpretation of "without unreasonable delay."
But you also shouldn't notify patients the day your vendor calls with preliminary suspicions. The regulation allows for some investigation time, and premature notification with incomplete facts serves no one.
The framework that works: treat vendor notification of suspicious activity as triggering your breach assessment, not your patient notification. Give yourself 30 days maximum to gather facts. If your Business Associate can't confirm within that window whether PHI was accessed, default to assuming it was and start notification. If the vendor later provides evidence the breach was smaller than feared, that's a better problem than explaining to OCR why you waited months for perfect information.
Document everything. Your breach assessment should show you pressed the vendor for answers, evaluated the risk with available facts, and made a reasoned decision about notification timing. That documentation is what OCR will review if your timeline gets challenged.
The Millstone incident shows what happens when investigation drags on without clear deadlines. Don't let your vendor's forensic timeline dictate your compliance obligations. You own the notification decision, even when the breach happened in someone else's environment.
