Breach Notification Deadline

Is there such a thing as a leap year law? Once every four years (e.g., 2000, 2004, 2008, 2012), there is a February 29th. Years with this extra calendar date are, of course, called leap years. The existence of an extra day in a year can change a legal deadline. This year, because there is an extra day, February 29, the breach notification deadline for reporting certain breaches to the Office for Civil Rights (OCR) is on a different date than in a regular year. The fact of a leap year has changed the reporting deadline, as discussed below.

Why Do We Have Leap Years?

The reason why we have leap years involves science and math, not law. The Gregorian calendar, so named because it was created by Pope Gregory XIII in the 16th century, contains 365 days. 

However, it takes Earth more than 365 days to revolve around the sun once. It actually takes (as Gregory’s astronomers learned) approximately 365.242189 days, or 365 days, 5 hours, 48 minutes, and 45 seconds, for the Earth to circle once around the Sun. This 365 days, 5 hours, 48 minutes, and 45 seconds, is called the astronomical year.

Leap days are added to keep the calendar year synchronized with the astronomical year. Because astronomical events do not repeat in a whole number of days, calendars that have the same number of days in each year drift over time with respect to the event that the year is supposed to track. By inserting a leap day every four years, this “drift” is corrected. If we did not add a leap day on February 29 nearly every four years, we would lose almost six hours off our calendar every single year. After only 100 years, our calendar would be off by around 24 days.

What is a Legal Year?

Maybe not surprisingly, there are differing court opinions on what a legal year is, in the context of a leap year and law.

Leap Year Law: HIPAA Breach Notification Deadline

The HIPAA breach notification rule states that if a breach affects fewer than 500 individuals, the covered entity may notify the Secretary of Health and Human Services (HHS) of such breaches on an annual basis. The breach notification deadline for breaches affecting fewer than 500 individuals is no later than 60 days after the end of the calendar year in which the breaches are discovered.

“60 days” (like “365 days,” above) means just that – “count each date, up to 60, and when you get to the 60th date, that date is the deadline.” In a non-leap year, the end of the previous calendar year is December 31. Sixty days from that is March 1. So, the breach notification deadline in a non-leap year is March 1. 

What about a leap year?  In a leap year, too, the end of the previous calendar year is December 31. But, because a leap year has a February 29, that date must be counted as part of the 60-day count. So, in 2020, the breach notification deadline is February 29, not March 1. 

Some cases addressing leap year law are addressed below.

In this case, a California defendant was convicted under a law providing that a lawful permanent resident who commits “a crime of violence punishable by at least one year in prison” has committed an “aggravated felony.”

Leap Year Law: “The Calendar Year Case”

In 1997, a Massachusetts man was tried and convicted of the crimes of home invasion, assault and battery by means of a dangerous weapon, and armed assault in a dwelling house. The defendant was sentenced to ten years in prison. He argued that he should have been released early. He argued that since two years of his sentence were leap years, he had in fact served “two extra days” and should have been released two days early. The Massachusetts appeals court hearing his appeal looked to how the Massachusetts criminal laws defined the word “year.” Those laws defined the word “year” as a calendar year. Therefore, defendant’s argument was rejected. “Calendar year,” the court stated, meant what the legislature said it meant – the dictionary definition of that term: 12 full months. Meaning, no extra credit, and no early release.

Leap Year Law: “The 365-Day Year Case”

In this leap year case, a California defendant was convicted under a law providing that a lawful permanent resident who commits “a crime of violence punishable by at least one year in prison” has committed an “aggravated felony.” Under some circumstances, lawful permanent residents are entitled to have orders deporting them cancelled. However, at the time of the conviction (in 1999), a lawful permanent resident who had committed an aggravated felony was not eligible to have a deportation order cancelled. 

The defendant was convicted on November 3, 1999. He received a 365-day suspended sentence, to be served during the year 2000, which was a leap year. He served the sentence. Immigration and National Services (now Immigrations and Customs Enforcement, or ICE) sought to deport the defendant. 

He argued that because an ”aggravated felony” is defined as “a crime of violence punishable by at least one year in prison,” ….. and his 365–day sentence was completed during a leap year, which was 366 days long, his conviction did not qualify as an “aggravated felony.” In other words, he argued that since he only served 365 out of 366 days in a year, he did not serve a full year. Therefore, he argued, he did not commit “a crime of violence punishable by at least one year in prison.”  

The defendant made this argument to the Board of Immigration Appeals (BIA). The BIA regulations defined a year as being “365 days.” His argument therefore failed, because he had served 365 days – a year.

What Do These Leap Year Law Cases Have in Common?

The two cases above both involved laws defining a year. What the cases have in common is that the court used the government’s definition of “year” to decide the outcome. This reflects an important common-sense principle of law courts use: When words in a law have a defined meaning (such as “calendar year” or “365 days”), courts must use the defined meaning in interpreting those laws. 

Prevent HIPAA Breaches

Don’t fall victim to breaches. Protect your business by becoming compliant today!