When must I send the notice to individuals?

Send notices promptly after discovery and once facts are reasonably known. Federal HIPAA guidance and most state laws require notice without unreasonable delay; HIPAA sets a 60-day window for certain breaches. Document discovery, interim notices, and justification for any delay.

Can the notice be electronically signed and delivered?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and durable record retention are met. For consumer-facing notices, ensure consumer consent to electronic records when required.

What if the data were encrypted or redacted?

State laws and HIPAA may permit clarification that encrypted data were involved; still disclose the nature of the data and whether protective measures were in place. Be precise—overstating or understating protections can invite regulator scrutiny.

Is notarization or witness signature required?

Security Notification Letters rarely require notarization or witnesses. If contractual terms or state law impose such requirements for a specific recipient or record, follow those terms and retain notarized copies accordingly.

How should I store signed notices and evidence?

Retain signed letters and audit trails in encrypted storage with access controls. Follow federal and industry retention rules (for example, HIPAA 6 years) and keep records readily retrievable for regulatory audits.

Can I revise or recall a sent notice?

You may issue a corrected notice if material facts change; document the correction, send updates to the same recipients, and retain both the original and corrected records for compliance and evidentiary purposes.

Electronic Signature
Templates
Miscellaneous
Security Notification Letter

Security Notification Letter

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SECURITY NOTIFICATION LETTER

Sender Name: Title:

Sender Address

Recipient Name: Recipient Title:

Recipient Address

RECITALS

WHEREAS, the Sender operates information systems and services that process and store data, and the Sender maintains obligations to notify affected persons and counterparties in the event of unauthorized access to systems or data; and

WHEREAS, on or about the Sender identified a security incident involving certain systems and data; and

WHEREAS, the Sender seeks to provide timely notice to the Recipient of the incident, describe the nature and scope of the incident, and set forth immediate remedial steps and any agreed post-incident responsibilities.

NOTIFICATION DETAILS & SCOPE OF INCIDENT

Incident Summary Types of Affected Data Systems Affected

ACTIONS TAKEN AND RECOMMENDATIONS

Immediate Actions Taken by Sender Recommended Actions for Recipient

Does the Recipient require additional assistance from the Sender? Yes No

PAYMENT TERMS (IF APPLICABLE)

Where the Sender provides remediation services beyond notification, the parties agree the Recipient will pay for such services in the amounts and on the schedule set forth below.

Estimated Remediation Fee Payment Schedule Late Payment Fee

TERM, TERMINATION, AND NOTICE

This Security Notification and any ancillary remediation obligations commence on and continue until unless earlier terminated in accordance with the terms herein.

Either party may terminate any remediation engagement on days written notice to the other party; termination does not relieve the Recipient of payment obligations for services rendered prior to termination.

CONFIDENTIALITY

All non-public information relating to the incident, including this notification, investigation materials, technical findings and affected data, shall be treated as Confidential Information. The Recipient shall not disclose such information except as required by law, regulation, or valid order of a court or regulatory authority, and then only after providing prompt written notice to the Sender to permit the Sender to seek protective measures.

The Recipient acknowledges that unauthorized disclosure of Confidential Information may cause irreparable harm for which monetary damages would be an inadequate remedy, and agrees the Sender may seek injunctive relief in addition to other available remedies.

Recipient acknowledges and agrees to maintain the confidentiality of this notification: I acknowledge and agree

GOVERNING LAW

This Notification Letter and any dispute arising under or related to it shall be governed by and construed in accordance with the laws of the State of without regard to conflict-of-law principles.

ENTIRE AGREEMENT; REPRESENTATIONS

This Security Notification Letter, together with any written attachments or exhibits expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter of this notice and supersedes all prior and contemporaneous agreements, understandings, representations and communications, whether written or oral.

Each party represents that it has the authority to enter into this notice and any remediation engagement described herein, and that the signatory below is authorized to bind the respective party.

ADDITIONAL PROVISIONS

Attachments and Exhibits Additional Notes

Notifier (Company):

By:

Date:

Notified Party (Recipient):

By:

Date:

What a Security Notification Letter Is

A Security Notification Letter is a formal written notice sent to individuals, regulators, and business partners to disclose a data security incident that may have exposed personal or sensitive information. It summarizes the event, the categories of data involved, discovery and containment actions, and the remediation measures available to affected parties. The letter documents the organization’s response and provides contact details for further questions, helping satisfy statutory notification obligations and preserving evidence for audits or regulatory review.

Why this Letter Matters for Compliance and Risk

A Security Notification Letter documents breach response, helps satisfy state and federal notice obligations, and creates an auditable record for regulators and insurers while limiting legal and reputational exposure.

Who Typically Prepares and Sends This Notice

Organizations, legal and compliance teams, HR, and IT departments use this letter to notify affected individuals, regulators, and business partners after a security incident.

Corporate data privacy officers managing incident response and regulator communications.
Healthcare providers issuing HIPAA-required breach notifications to patients and HHS when PHI is involved.
Financial institutions, insurers, and legal firms informing clients and fulfilling statutory notice requirements.

Use a clear, documented template tailored to incident specifics and preserve copies for retention, reporting, and potential regulatory review.

Essential Sections to Include in the Letter

Organize the Security Notification Letter into clear sections to meet legal requirements, explain the incident, and describe remediation and available protections for recipients.

Header

Include organization name, incident reference number, notification date, and recipient classification. A clear header helps recipients and regulators identify the incident and aligns with internal tracking records and case IDs.

Incident summary

Summarize the nature of the incident, discovery and detection dates, and the period of unauthorized access. Keep language factual and avoid speculation while noting whether the matter is under active investigation.

Data affected

List categories of personal or sensitive information involved (for example: names, SSNs, financial records, PHI, login credentials). Specify whether the data were encrypted or redacted and provide scope where known.

Remediation

Describe containment steps, forensic analysis, third-party advisors retained, patches or configuration changes applied, and monitoring actions implemented to prevent recurrence.

Protective steps

Explain credit monitoring, identity theft protection, or reimbursement offers including eligibility, enrollment instructions, and duration; be specific about what the organization will and will not cover.

Contact & legal

Provide a dedicated phone number, secure email, and mailing address for inquiries, plus legal notices about rights, dispute processes, and privacy office contact details.

Required Data Elements for the Letter

Incident ID: Unique reference assigned by the security team

Notification Date: Date sent to recipients (MM/DD/YYYY)

Affected Data: Categories (PHI, SSN, financial, credentials)

Discovery Date: When the incident was first detected

Remediation Actions: Containment, investigation, and patching

Contact Information: Phone, secure email, and mailing address

Step-by-Step: Preparing and Sending the Letter

Follow these steps to prepare and send a compliant Security Notification Letter after confirming an incident and assessing scope.

01

Confirm Incident: Verify scope, affected data types, and current investigation status
02

Assemble Evidence: Collect logs, forensic reports, and a clear incident timeline
03

Draft Letter: Use factual language, required disclosure elements, and plain English
04

Send & Record: Deliver via the required channels and retain signed copies and audit trails

Configuring an Online Notification Workflow

Configure document fields, signer authentication, and retention settings before sending the letter through an eSignature platform or secure delivery system.

Document workflow field and purpose	How field behaves in notification workflow
Signer authentication method and strength	Email link, SMS code, or knowledge-based authentication
Conditional fields and visibility rules	Show fields only when applicable to the recipient
Template placeholders and auto-fill sources	Map values from user directory or prior submissions
Retention and audit log storage settings	Enable audit trail and set retention per policy

Where to Send and How Notices Are Routed

Select recipients and delivery channels to meet legal obligations: individuals, regulators, credit bureaus, and affected partners each have distinct routing needs.

To Individuals: Send via mailed letter and secure email where authorized
Regulators: Notify state attorneys general or sector regulators by required method
Credit Bureaus: Contact bureaus per their reporting procedures when credit data exposed
Partners/Vendors: Inform contractual partners and impacted vendors per service agreements

Technical and Platform Considerations for Digital Delivery

Use secure channels and compliant eSignature platforms for preparation, signature capture, delivery, and recordkeeping to maintain chain-of-custody and satisfy regulatory obligations.

File Formats: PDF, PDF/A, and DOCX formats
Integrations: Connectors for Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS code, or advanced MFA

Timing and Deadlines to Watch

Notification timelines vary; federal rules provide specific deadlines for healthcare incidents while state breach laws set additional promptness and content standards.

HIPAA Breach Timeline:

Notify affected individuals and HHS within 60 days for breaches affecting PHI

State Data-Breach Laws:

Most require notice without unreasonable delay; many specify 30–60 days

Small-Breach Thresholds:

States differ on thresholds and trigger events for notice

Regulatory Filings:

Certain regulators may require incident reports or direct notifications

Internal Deadlines:

Preserve evidence immediately and notify executives within 24–72 hours

Common Mistakes to Avoid

Delaying notification while awaiting a full investigation can violate promptness requirements and increase legal exposure; document interim notices and timelines to show good faith.
Overly technical explanations confuse recipients; use plain language, specify affected data categories, and avoid minimizing the scope of risk in the notice.
Failing to include required regulatory contacts or missing state-specific notice elements often prompts regulator follow-up and potential enforcement action.
Using insecure delivery channels or failing to retain audit logs undermines legal defensibility and complicates breach response, remediation, and insurance claims.

Penalties and Risks of Incomplete or Late Notices

Regulatory fines: State attorney general or federal penalties

HIPAA penalties: Civil penalties under HIPAA rules

Civil litigation: Class actions and statutory damages

Reputational harm: Loss of customer trust and revenue

Operational costs: Remediation, credit monitoring, and legal fees

Recordkeeping risk: Insufficient records hamper legal defense

How This Letter Differs from Related Documents

Compare the Security Notification Letter with related records to clarify purpose, audience, and the legal expectations that apply to each type of post-incident communication.

Document type and intended audience	Notification Letter	Incident Report	Regulator Filing	Public Statement
Primary purpose	inform affected parties	internal record	regulatory compliance	public disclosure
Typical audience	individuals and partners	it and response teams	agencies and ags	media and customers
Legal effect	satisfies notice duties	evidence for investigation	formal compliance record	reputation management
Distribution method	mail/email	internal systems	regulator portal	press release

Practical Examples of Secure Notification Workflows

These examples show how organizations used secure, auditable delivery and eSignature workflows to distribute notices, document responses, and preserve evidence.

Optica Ventures

Optica replaced paper notices with secure electronic letters to reduce delivery time and preserve evidence.

Outcome: faster delivery and better recordkeeping.
By using secure delivery and retained audit logs, Optica met regulator expectations, simplified follow-up with affected parties, and maintained a clear chain-of-custody for the investigation.

Fertility Centers of Illinois

A healthcare provider used HIPAA-compliant eSignature and BAA-covered workflows to notify patients promptly.

Outcome: HIPAA-aligned notices and documented consents.
The provider combined patient outreach with protective measures, preserved required audit trails, and supported timely HHS reporting where required while minimizing administrative friction.

Who May Sign or Authorize the Letter

Chief Privacy Officer

Often responsible for overseeing the notice, coordinating legal review, and approving final content. The CPO typically signs or authorizes distribution and ensures regulatory consistency across jurisdictions, retaining audit records of delivery and consent where required.

General Counsel

Provides legal assessment of disclosure obligations, approves language to limit liability, and certifies regulatory filings. General Counsel involvement is common for material incidents or when privileged information is implicated.

Frequently Asked Questions and Practical Answers

Answers to common questions about drafting, signing, delivering, and retaining Security Notification Letters, with practical steps to avoid common pitfalls.

Need help? Contact support

When must I send the notice to individuals?
Send notices promptly after discovery and once facts are reasonably known. Federal HIPAA guidance and most state laws require notice without unreasonable delay; HIPAA sets a 60-day window for certain breaches. Document discovery, interim notices, and justification for any delay.
Can the notice be electronically signed and delivered?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and durable record retention are met. For consumer-facing notices, ensure consumer consent to electronic records when required.
What if the data were encrypted or redacted?
State laws and HIPAA may permit clarification that encrypted data were involved; still disclose the nature of the data and whether protective measures were in place. Be precise—overstating or understating protections can invite regulator scrutiny.
Is notarization or witness signature required?
Security Notification Letters rarely require notarization or witnesses. If contractual terms or state law impose such requirements for a specific recipient or record, follow those terms and retain notarized copies accordingly.
How should I store signed notices and evidence?
Retain signed letters and audit trails in encrypted storage with access controls. Follow federal and industry retention rules (for example, HIPAA 6 years) and keep records readily retrievable for regulatory audits.
Can I revise or recall a sent notice?
You may issue a corrected notice if material facts change; document the correction, send updates to the same recipients, and retain both the original and corrected records for compliance and evidentiary purposes.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now