---
title: "List what was exposed before deciding any breach notice"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A51-MA20261022-1-US"
practice_area: "Confidentiality & client information"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# List what was exposed before deciding any breach notice

> List the kind of information, the number of people if the file states it, and the date the file gives for discovery. Do not say a notice is required and do not draft one.

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List the kind of information, the number of people if the file states it, and the date the file gives for discovery. Do not say a notice is required and do not draft one. |
| What the lawyer must review | You decide whether any notice statute applies. No state data-breach statute was opened. The HHS breach page applies to a breach of unsecured protected health information by a covered entity or its business associate. Individual notice is without unreasonable delay and in no case later than 60 days following discovery. Media notice is required when more than 500 residents of a State or jurisdiction are affected. A business associate notifies the covered entity. The page describes exceptions and a risk assessment. You read those before you use the 60 days. An ordinary client file is not that breach unless you decide the information is unsecured protected health information held by a covered entity or business associate. 45 CFR § 164.502(a) is the use-and-disclosure limit for that information. Formal Opinion 512 applies before the file goes into a tool. |
| Written for | United States |
| Applies to | [Assess a suspected breach of client personal information under the notifiable data breach scheme](https://ailawframework.com/obligations/confidentiality-and-client-information/assess-a-suspected-breach-of-client-personal-information-under-the-notif.md) |

## Checking plan

- What the AI does: List the kind of information, the number of people if the file states it, and the date the file gives for discovery. Do not say a notice is required and do not draft one.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Do not apply the 60-day period to a client file that is not unsecured protected health information.
- The number of people is taken from the file. It is not estimated.

## Sources

- [HHS, Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) (checked 2026-10-22)
- [45 CFR § 164.502 (uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*