Skip to content
STC
Free Generator

Breach Notification Letter Generator

Generate compliant breach notification letters for HIPAA, GDPR, state Attorney General requirements, and customer communications. Customize fields, preview in real time, and export as plain text for legal review.

Letter Template

Customize Fields

Legal review required. Generated letters are starting drafts only. Always have legal counsel review before sending. Regulatory requirements vary by jurisdiction and breach type.

HIPAA, Patient Breach Notification

DRAFT, Review by legal counsel before sending

Dear Valued Patient, We are writing to inform you of a data security incident that may have involved some of your personal information. What Happened On [Date], [Your Organization Name] discovered that unauthorized access to our electronic systems. We immediately launched an investigation to determine what information was involved. What Information Was Involved The investigation determined that the following types of information may have been involved: names, dates of birth, medical record numbers, and treatment information. What We Are Doing We immediately secured the affected systems, engaged a forensic investigation firm, and notified law enforcement. We have also implemented additional safeguards to prevent similar incidents from occurring in the future. What You Can Do We recommend that you review your account statements, monitor your credit reports, and report any suspicious activity. We are also providing you with complimentary credit monitoring and identity theft protection services. Enrollment instructions are enclosed. For More Information If you have questions or need assistance, please contact Privacy Officer at [Phone Number] or privacy@[domain].com. We sincerely apologize for any inconvenience or concern this may cause you. Protecting your privacy and the security of your information is one of our highest priorities. Sincerely, [Your Organization Name]

Email me this letter

Want a copy in your inbox? Verify your email once and we'll send the letter you've built straight over.

Notification Deadlines at a Glance

HIPAA (HHS)
Deadline: 60 days
Notify: Affected individuals + HHS OCR + media (if >500)
Must include: Must include: breach description, types of data, steps taken, contact info
GDPR (Art. 33)
Deadline: 72 hours
Notify: Supervisory Authority
Must include: Must include: nature, categories, subjects, likely consequences, measures taken
GDPR (Art. 34)
Deadline: Without undue delay
Notify: Affected data subjects
Must include: Required if high risk to rights and freedoms
State Laws (CA CCPA/CMIA, NY SHIELD, etc.)
Deadline: Varies: 72h – 60 days
Notify: State AG + affected residents
Must include: Many states also require credit monitoring if SSN involved
Recommended Training

Data Privacy & Information Handling

Protect PII, customer records, and confidential documents

The best notification is the one you never send. This course reduces the human error that causes breaches in the first place.

Free to use this tool, no signup required. Training is billed per seat, annually.

Talk with Us