Data Breach Requirements
There are both State and Federal regulatory schemes that deal with data breaches and notification of those whose personally identifiable information may have been compromised. We are able to provide the resources that allow the identification of the individuals who need to be notified of a breach. We generally perform these services in conjunction with forensic experts who obtain the data that needs to be reviewed, cyber security experts and lawyers who specialize in data breach matters.
The sources of federal law that most frequently come into play are in the medical information area, HIPPA regulations (45 CFR Parts 160 and 164) and in the financial services area, the Gramm-Leach-Bliley Act (15 USC Sec 6801 et. seq.) and the regulations issued thereunder.
Notification of a breach is required pursuant to HIPPA without unreasonable delay and in no case later than 60 days following the discovery of a breach. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
Notification of a breach is required pursuant to the Gramm-Leach-Bliley Act to “the affected customer as soon as possible.”
Each state has its own regulatory scheme that must be followed in conjunction with breaches of the data of its citizens. It is wise to read the statutes together and comply with the most aggressive timeline of notification. Click on the State you are interested in and you will find a link to the State Law provisions regarding data breach.
newusa ( copy)
State Statute Notification Requirements
Alabama
Timeline for Notification
within 45 days of the covered entity’s receipt of notice
Statute
Alaska
Timeline for Notification
in the most expeditious time possible and without unreasonable delay
Statute
Arizona
Timeline for Notification
within 45 days after a determination that a breach has occurred
Statute
Arkansas
Timeline for Notification
in the most expedient time and manner possible and without unreasonable delay
Statute
California
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Colorado
Timeline for Notification
in the most expedient time possible and without unreasonable delay, but not later than thirty days
Statute
Colo. Rev. Stat. § 6-1-716 (2)
Connecticut
Timeline for Notification
without unreasonable delay but not later than ninety days
Statute
Conn. Gen. Stat. § 36a-701b (b)(1)
Delaware
Timeline for Notification
without unreasonable delay but not later than 60 days
Statute
Del. Code Ann. tit. 6 § 12B-102 (c)
District of Columbia
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Florida
Timeline for Notification
as expeditiously as practicable, but no later than 30 days
Statute
Georgia
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Hawaii
Idaho
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Illinois
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Indiana
Iowa
Timeline for Notification
in the most expeditious manner possible and without unreasonable delay
Statute
Kansas
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Kentucky
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Louisiana
Timeline for Notification
in the most expedient time possible and without unreasonable delay, but not later than 60 days
Statute
Maine
Timeline for Notification
as expediently as possible and without unreasonable delay
Statute
10 Me. Rev. Stat. § 1348 (1) (A)
Maryland
Timeline for Notification
as reasonably practicable, but not later than 45 days
Statute
Massachusetts
Timeline for Notification
as soon as practicable and without unreasonable delay
Statute
Michigan
Timeline for Notification
without unreasonable delay
Statute
Mich. Comp. Laws § Section 445.72 Sec 12 (4)
Minnesota
Timeline for Notification
most expedient time possible and without unreasonable dela
Statute
Minn. Stat. 325E.61 § Subd. 1 (a)
Mississippi
Missouri
Montana
Nebraska
Timeline for Notification
as soon as possible and without unreasonable delay
Statute
Nevada
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
New Hampshire
New Hampshire
New Jersey
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
New Mexico
Timeline for Notification
in the most expedient time possible, but not later than 45 days
Statute
New York
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
North Carolina
North Dakota
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Ohio
Timeline for Notification
in the most expedient time possible but not later than forty-five days
Statute
Ohio Rev Code § 1349.19 (B) (2)
Oklahoma
Oregon
Timeline for Notification
most expeditious manner possible, without unreasonable delay, but not later than 45 days
Statute
Pennsylvania
Rhode Island
Timeline for Notification
in the most expedient time possible but no later than forty-five (45) calendar days
Statute
R.I. Gen. Laws § 11-49.3-4 (a) (2)
South Carolina
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
South Dakota
Tennessee
Timeline for Notification
no later than forty-five (45) days
Statute
Texas
Timeline for Notification
without unreasonable delay and not later than the 60th day
Statute
Tex. Bus. & Com. Code § Sec. 521.053 (b)
Utah
Timeline for Notification
in the most expedient time possible without unreasonable delay
Statute
Vermont
Timeline for Notification
in the most expedient time possible and without unreasonable delay, but not later than 45 days
Statute
Virginia
Virginia
Washington
West Virginia
Wisconsin
Timeline for Notification
within a reasonable time, not to exceed 45 days
Statute
Wyoming
Timeline for Notification
in the most expedient time possible and without unreasonable delay
Statute
Legal Outsourcing Resources
Ethics of Legal Outsourcing
ABA Formal Opinion 08-451 August 5, 2008 Lawyer’s Obligations When Outsourcing