Comment on FR Doc # E9-20169

There appears to be a technical error in paragraph 164.408(c) “Breaches involving less than 500 individuals”, which states: “… not later than 60 days after the end of each calendar year, provide the notification required by paragraph (a) of this section for breaches occurring during the preceding calendar year …” Please note that a covered entity might not become aware of a breach until several months after it occurred. As it currently reads, the regulation might require a covered entity to notify the Secretary before becoming aware of the breach. I recommend revising that paragraph to read “… not later than 60 days after the end of each calendar year, provide the notification required by paragraph (a) of this section for breaches of which the covered entity became aware during the preceding calendar year …”