Breach Notification for Clinical Dental AI: What Happens When the Vendor Holding Your PHI Has an Incident

In February 2024, a ransomware attack on Change Healthcare — a claims clearinghouse operating as a business associate, not a provider — ultimately affected the health information of more than 190 million people, according to figures UnitedHealth Group reported to HHS. Thousands of providers that had never been breached themselves had to work out, in real time, who owed notice to whom and by when.

Clinical dental AI puts your practice in the same position at a smaller scale. Your AI vendor holds radiographs, periodontal charts, CDT-coded treatment plans, and free-text clinical notes, and when its environment is compromised, the HIPAA Breach Notification Rule decides what happens next.

Most vendor diligence — including our own coverage of HIPAA compliance for clinical dental AI and SOC 2 Type II for clinical vendors — focuses on what happens before an incident. This post covers the incident itself: the notification clock, the four-factor risk assessment, and the decisions a practice or DSO must make once the vendor's notice lands.

What Counts As A Breach Under HIPAA?

Under 45 CFR 164.402, a breach is the acquisition, access, use, or disclosure of protected health information in a manner the Privacy Rule does not permit, which compromises the security or privacy of that information. The 2013 Omnibus Rule changed the default: an impermissible use or disclosure is now presumed to be a breach unless the covered entity or business associate can demonstrate a low probability that the PHI was compromised.

That presumption matters in an AI incident. Your vendor does not get to call an event a non-breach because nobody saw evidence of exfiltration — it has to prove low probability through a documented risk assessment, or notify.

The rule also applies only to unsecured PHI. HHS guidance treats PHI as secured when it has been encrypted consistent with NIST standards (such as SP 800-111 for data at rest and SP 800-52 for TLS in transit) or destroyed, which creates a safe harbor from notification.

Keep in mind that the safe harbor holds only while the decryption keys stay out of the attacker's reach. If the same compromised IAM role that touched the S3 bucket could also call kms:Decrypt on the customer-managed key in AWS KMS, the encryption bought you nothing.

The rule carves out three narrow exceptions, and none of them fits most vendor incidents:

• Good-faith workforce access. An unintentional acquisition or use by a workforce member acting in good faith and within the scope of their authority, with no further impermissible use.
• Inadvertent internal disclosure. A disclosure between two people authorized to access PHI at the same covered entity, business associate, or organized health care arrangement.
• Unable to retain. A disclosure where there is a good-faith belief the recipient could not reasonably have retained the information.

A ransomware crew, a misconfigured multi-tenant index, or a prompt-injection exfiltration falls outside all three. Accordingly, assume notification is required until the risk assessment says otherwise.

The Notification Timeline, Step By Step

The clock runs in stages, and each stage starts at a different moment of discovery. Under 45 CFR 164.410, a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovering the breach.

Note that 60 days is an outer limit, not a grace period. HHS has said plainly in the rule's preamble that a business associate sitting on known facts until day 59 can still violate the "without unreasonable delay" standard.

Discovery is also broader than most teams assume. A breach is treated as discovered on the first day it is known — or, by exercising reasonable diligence, would have been known — to any workforce member or agent other than the person who committed it.

AI stacks add a subcontractor layer to this chain. If your vendor runs inference through a model host such as Amazon Bedrock, or stores embeddings in a managed vector service, a compromise at that layer flows from subcontractor to vendor to you, and each hop can consume its own share of the 60 days.

Your own clock generally starts when you discover the breach, which in practice is usually when the vendor's notice arrives. However, if the vendor is acting as your agent under the federal common law of agency, HHS treats the vendor's discovery as your discovery — and your 60 days may already be partly spent before you hear a word.

Here is how the full set of obligations lines up once a breach is confirmed:

One exception can pause the clock. Under 45 CFR 164.412, a law enforcement official may request a delay if notice would impede a criminal investigation, and a written request can hold notification for the period it specifies.

Running The Four-Factor Risk Assessment On An AI Incident

The low-probability-of-compromise determination rests on at least four factors listed in 45 CFR 164.402. Each one reads differently when the compromised system is an AI pipeline rather than a practice management server, so here is how each factor applies:

• Nature and extent of the PHI. This covers the types of identifiers involved and the likelihood of re-identification. A prompt log holding a hygienist's free-text note with a patient name, date of birth, and subscriber ID carries far more risk than an aggregated CDT code count, and radiographs exported as DICOM often carry name and birth date in the file header.
• The unauthorized person. Who used or received the PHI changes the calculus. A misrouted query that returned another practice's records to a HIPAA-covered DSO is a different event from a ransomware affiliate staging data for extortion.
• Whether the PHI was actually acquired or viewed. This is a forensic question answered by logs, not assurances. If the vendor had CloudTrail data events and S3 server access logging enabled, it can show which objects were read; if logging was off, it cannot prove a negative.
• The extent of mitigation. Credential rotation, deletion attestations from a known recipient, and confirmed containment all count. That said, an assurance from a criminal group that it deleted your data carries essentially no weight.

All four factors have to be weighed together, and the analysis has to be written down. Under 45 CFR 164.414, the covered entity or business associate carries the burden of proving either that notifications went out or that the event was not a breach, and HIPAA documentation must be retained for six years.

This is why log design is a breach-response control and not just an observability choice. Our post on AI log retention for clinical systems covers how to keep enough audit trail to answer factor three without turning the logs themselves into a PHI liability.

Where AI Systems Make The Assessment Harder

Traditional breach response asks which database was touched. Clinical AI scatters PHI across stores that most incident runbooks were never written to inventory, including but not limited to the following:

• Prompt and completion logs. Tracing tools such as LangSmith, Datadog LLM Observability, or a homegrown DynamoDB table often capture full prompts and model outputs verbatim. These are frequently the least-protected copy of PHI in the stack.
• Vector indexes. Embeddings of clinical notes stored in Pinecone, Weaviate, or pgvector on Postgres look like opaque numbers, yet one 2023 study reconstructed 92% of 32-token inputs exactly from their embeddings. Treat a leaked index as potentially re-identifiable — see our breakdown of vector databases for clinical data.
• Agent tool access. An agent with read access to the Open Dental API can be steered by prompt injection in clinical systems into pulling records it was never asked for. The breach surface becomes everything the tool registry can reach, not just what the model was shown.
• Model-host subprocessors. Inference on Amazon Bedrock runs under the AWS BAA, and AWS states that Bedrock does not use customer prompts to train its models. Even so, any additional hosted model, fine-tuning job, or evaluation dataset is another place where the Bedrock architecture has to be traced during an incident.

Each of these stores needs its own answer to factors one and three. What's more, if PHI was de-identified under Safe Harbor or Expert Determination before it entered the pipeline, the vendor should be able to show that — and that evidence can move the risk assessment materially.

What Your Practice Should Do In The First 72 Hours

The vendor's notice starts your clock, and the first three days decide whether you spend the remaining 57 executing a plan or reconstructing facts. Here is the sequence we recommend:

1. Record the discovery date in writing. Note when the notice arrived, who received it, and whether anyone on your team had earlier signals, such as unusual API activity or a patient complaint.
2. Request the incident facts. Ask for the date of the breach, the date the vendor discovered it, the data elements involved, the list of affected patients by location, the logs supporting its conclusions, and confirmation of containment.
3. Rotate your side of the integration. Revoke and reissue API keys, OAuth tokens, and service credentials that connect the vendor to Open Dental, Dentrix, Eaglesoft, or your imaging system, even if the vendor says they were not exposed.
4. Engage breach counsel and your cyber insurer. Many cyber policies require prompt notice of a claim and may require panel-approved counsel and forensics firms, so notifying late can jeopardize coverage.
5. Decide who sends the notices. The BAA may delegate patient notification to the vendor, but the practice remains responsible for timing and content, so approve the letter, the mailing list, and the call-center script yourself.
6. Check every state where affected patients live. Multi-state DSOs in particular need a jurisdiction-by-jurisdiction map before any letter goes out.
7. Start the documentation file. Every request, response, decision, and draft goes into a record you can hand to OCR, retained for at least six years.

Once these seven steps are underway, the remaining work is execution rather than discovery. After all, the regulators reviewing your response will judge the decisions you made in week one far more than the polish of the letter in week eight.

What The Patient Notice Must Contain

Under 45 CFR 164.404(c), individual notice must be written in plain language and sent by first-class mail, or by email if the patient has agreed to electronic notice. It must include, at a minimum:

• What happened. A brief description of the incident, including the date of the breach and the date of discovery, if known.
• What was involved. The types of PHI exposed — for instance, name, date of birth, insurance subscriber ID, radiographs, or treatment notes.
• What patients should do. Concrete steps individuals can take to protect themselves from potential harm.
• What you are doing. The practice's investigation, mitigation, and steps to prevent a recurrence.
• How to reach you. Contact procedures that include a toll-free number, an email address, a website, or a postal address.

If contact information is out of date for 10 or more patients, substitute notice applies. That means either a conspicuous posting on your website for 90 days or notice in major print or broadcast media where those patients likely live, plus a toll-free number that stays active for at least 90 days.

Remember that dental records age quickly. A practice that migrated from Eaglesoft three years ago may hold historical patients with no valid address, so the substitute-notice threshold is easier to cross than it looks.

State Breach Laws Run In Parallel

HIPAA sets a federal floor, and every state has its own breach notification statute. Several states, including Colorado, Florida, and Washington, set 30-day deadlines for notifying residents under their general breach laws, and Texas requires notice to its attorney general within 30 days when 250 or more Texans are affected.

Some states treat HIPAA-compliant notice as satisfying their own statute; others layer on separate content, regulator, or timing requirements. Be aware that the shortest applicable deadline governs your schedule, which is why the jurisdiction map in step six belongs in the first 72 hours rather than week five.

What Late Or Missing Notification Costs

OCR enforces timeliness directly. In 2017, Presence Health paid $475,000 in the first HIPAA settlement based solely on untimely breach notification, after notifying patients and HHS roughly three months past the 60-day limit.

The incident itself costs far more. IBM's 2024 Cost of a Data Breach report put the average healthcare breach at approximately $9.77 million, the highest of any industry it studied, and forensics, notification, call centers, and credit monitoring arrive on that bill long before any penalty does.

State dental boards can add their own exposure where AI-assisted clinical records are concerned. Our survey of dental board rules on AI covers where recordkeeping obligations intersect with vendor-held data.

Write The Breach Terms Into The BAA Before You Need Them

Every decision in this post is easier if the contract already answers it. When you negotiate or renew a BAA with a clinical AI vendor, make sure it addresses the following terms:

• A shorter notice window. Require notice of a suspected security incident within a defined number of hours or business days, with a confirmed-breach report to follow, rather than accepting the 60-day regulatory ceiling.
• Required notice contents. Specify the patient list, data elements, dates, supporting logs, and containment status the vendor must deliver.
• Cost allocation. Assign who pays for forensics, notification mailings, call centers, and credit monitoring when the vendor's environment caused the breach.
• Subcontractor flow-down. Require every subprocessor, including model hosts and vector database providers, to sign a BAA with equal or stricter notice terms.
• Log retention and access. Require the audit logs needed to answer the four-factor assessment, retained long enough to be useful and available to you on request.
• Return and destruction. Define how PHI, embeddings, and logs are returned or destroyed at termination, with a written attestation.

All of these terms cost nothing to negotiate before an incident and are nearly impossible to obtain after one. Overall, a BAA that only restates the regulation leaves your practice carrying the gap between the vendor's 60 days and your own.

Get The Runbook Built Before The Notice Arrives

If you are holding a vendor's incident notice right now, or renewing a BAA that still accepts the 60-day ceiling, this is the moment to pressure-test your response. The team at NexV builds and operates HIPAA-grade clinical dental AI on Bedrock, and we work through vendor breach terms and PHI data-flow maps with practices and DSOs every week.

Reach out for a working session — we will review your BAA's breach provisions, inventory every store where your AI stack holds PHI, and leave you with a notification runbook your team can run on day one.