of smaller breaches affecting fewer than 500 individuals to HHS annually. The Breach Notification Rule also requires business associates to notify a . covered entity of breaches at or by the business associate. Visit the . HHS HIPAA Breach Notification Rule. webpage for guidance on: Administrative requirements and burden of proof.