# Hipaa compliant file sharing: Secure Transfer Obligations

> The Secure Transfer Obligations carries 3 published figures read from 5 sources' own pages, from 30 to 90 day, read 17 October 2026.

Batesio · https://batesio.com/datasets/secure-transfer-obligations/ · computed 2026-10-18

**Range of the published figures:** 30 to 90 day (range 30 to 90 day; 3 sources with a figure; 5 of 16 sources read publish one).

5 of the 16 named sources read in full publish a figure; 11 publish none, read 17 October 2026.

## By regime

| Breakdown | Median | Range | Sources |
|---|---|---|---|
| regime ftc-safeguards | 30 day | 30 to 30 day | 1 |
| regime hipaa-security-guidance | 12 month | 12 to 12 month | 1 |
| regime hipaa-breach-notification | 60 day | 60 to 60 day | 1 |
| regime 45-cfr-164-subpart-d | 90 day | 90 to 90 day | 1 |
| regime hipaa-security-nprm | 12 month | 12 to 12 month | 1 |

## Every figure, with its source

One row per source: the figure the source's own page publishes, the page, and the day it was read.

| Source | Figure | Breakdown | Read |
|---|---|---|---|
| [eCFR 45 CFR part 164 subpart D (breach notification)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D) | 90 day | 45-cfr-164-subpart-d | 2026-10-17 |
| [HHS: breach reporting to the Secretary](https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html) | 60 day | hipaa-breach-notification | 2026-10-12 |
| [FTC Safeguards Rule: what your business needs to know](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) | 30 day | ftc-safeguards | 2026-10-17 |
| [HHS: Security Rule guidance material](https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html) | 12 month | hipaa-security-guidance | 2026-10-17 |
| [HHS: Security Rule NPRM fact sheet](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html) | 12 month | hipaa-security-nprm | 2026-10-17 |

## The sentence each figure was read from (5)

- [eCFR 45 CFR part 164 subpart D (breach notification)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D), read 2026-10-17: "(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and"
- [HHS: breach reporting to the Secretary](https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html), read 2026-10-12: "Within 60 days after the end of the calendar year in which the breach was discovered"
- [FTC Safeguards Rule: what your business needs to know](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know), read 2026-10-17: "Section 314.4(j) of the Safeguards Rule requires financial institutions to notify the FTC as soon as possible – and no later than 30 days after discovery – of a “notification event.” For purposes of the Rule, a “notification event” is a security breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information."
- [HHS: Security Rule guidance material](https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html), read 2026-10-17: "The statute requires OCR to take into consideration in certain Security Rule enforcement and audit activities whether a regulated entity has adequately demonstrated that recognized security practices were “in place” for the prior 12 months."
- [HHS: Security Rule NPRM fact sheet](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html), read 2026-10-17: "Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, but at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI."

## Read in full, publishes no figure

- [HHS: HIPAA Security Rule laws and regulations](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html), read 2026-09-11: read in full and no accepted figure on the page
- [HHS: the Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html), read 2026-10-10: read in full and no accepted figure on the page
- [HHS: guidance on HIPAA and cloud computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html), read 2026-09-12: read in full and no accepted figure on the page
- [HHS: business associates FAQ](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html), read 2026-09-26: read in full and no accepted figure on the page
- [eCFR 45 CFR 164.312 technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312), read 2026-10-17: read in full and no accepted figure on the page
- [HHS: minimum necessary requirement](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html), read 2026-09-12: read in full and no accepted figure on the page
- [FTC: Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), read 2026-10-17: read in full and no accepted figure on the page
- [ICO: a guide to data security (UK GDPR)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), read 2026-10-11: read in full and no accepted figure on the page
- [ICO: encryption](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/), read 2026-10-17: read in full and no accepted figure on the page
- [NIST SP 800-66r2: implementing the HIPAA Security Rule](https://csrc.nist.gov/pubs/sp/800/66/r2/final), read 2026-09-12: read in full and no accepted figure on the page
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework), read 2026-10-11: read in full and no accepted figure on the page

## Methodology

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 5 of the 16 named sources that could be read published a usable figure; 11 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 9 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per requirement, quoted verbatim from the regulator with its effective date and its status (required, addressable, proposed), so a reader can see that HIPAA makes encryption ADDRESSABLE today and that the December 2024 NPRM would make it required; the cross-regime comparison - what HIPAA, the FTC Safeguards Rule and UK GDPR each demand of the same transfer - is the figure; changed-since, which is the news when a rule is finalised

## Sources

- [HHS: HIPAA Security Rule laws and regulations](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS: Security Rule guidance material](https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS: the Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS: guidance on HIPAA and cloud computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS: business associates FAQ](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS: breach reporting to the Secretary](https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html) (the publisher's own terms; quoted for reporting and comment)
- [HHS: Security Rule NPRM fact sheet](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html) (the publisher's own terms; quoted for reporting and comment)
- [eCFR 45 CFR 164.312 technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) (the publisher's own terms; quoted for reporting and comment)
- [eCFR 45 CFR part 164 subpart D (breach notification)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D) (the publisher's own terms; quoted for reporting and comment)
- [HHS: minimum necessary requirement](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html) (the publisher's own terms; quoted for reporting and comment)
- [FTC Safeguards Rule: what your business needs to know](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) (the publisher's own terms; quoted for reporting and comment)
- [FTC: Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act) (the publisher's own terms; quoted for reporting and comment)
- [ICO: a guide to data security (UK GDPR)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) (the publisher's own terms; quoted for reporting and comment)
- [ICO: encryption](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/) (the publisher's own terms; quoted for reporting and comment)
- [NIST SP 800-66r2: implementing the HIPAA Security Rule](https://csrc.nist.gov/pubs/sp/800/66/r2/final) (the publisher's own terms; quoted for reporting and comment)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) (the publisher's own terms; quoted for reporting and comment)

## Cite or embed

- The Secure Transfer Obligations carries 3 published figures read from 5 sources' own pages, from 30 to 90 day, read 17 October 2026.
- 5 of the 16 named sources read in full publish a figure; 11 publish none, read 17 October 2026.
- Secure Transfer Obligations, regime ftc-safeguards: median 30 day across 1 source, read 17 October 2026.
- Secure Transfer Obligations, regime hipaa-security-guidance: median 12 month across 1 source, read 17 October 2026.
- Secure Transfer Obligations, regime hipaa-breach-notification: median 60 day across 1 source, read 17 October 2026.
- Secure Transfer Obligations, regime 45-cfr-164-subpart-d: median 90 day across 1 source, read 17 October 2026.
- Secure Transfer Obligations, regime hipaa-security-nprm: median 12 month across 1 source, read 17 October 2026.

Cite as: "Batesio Secure Transfer Obligations", updated 2026-10-18, https://batesio.com/datasets/secure-transfer-obligations/.

CSV: https://batesio.com/datasets/secure-transfer-obligations.csv
JSON: https://batesio.com/datasets/secure-transfer-obligations.json
Embed (plain HTML, static link back): see https://batesio.com/datasets/secure-transfer-obligations/#median