Data Breach Response and Notification

California licensed healthcare facilities

“The article identifies fixed notification periods of 15 business days for California licensed healthcare facilities; 30 days for Colorado, Florida, Maine, New York, and Washington; 45 days for Alabama, Arizona, Indiana, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont, and Wisconsin; and 60 days for Connecticut, Delaware, Louisiana, South Dakota, and Texas. Many other states and the District of Columbia use a “without unreasonable delay” standard.”

ShieldForce

where the breach is likely to risk individuals’ rights and freedoms

“Under GDPR Article 33, a controller must notify the DSB without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals’ rights and freedoms. The 72-hour period is a ceiling, not permission to wait. If all information is not available, the controller may submit an initial notification and provide supplementary information later.”

Global Law Experts

California licensed healthcare facilities, including home health agencies

“That provision requires notification to affected patients and the California Department of Public Health within 15 business days of discovery.”

ShieldForce

where feasible; notification is also due without undue delay

“Under the EU GDPR, a controller must notify the competent supervisory authority unless a breach is unlikely to pose a risk to individuals’ rights and freedoms; required notification is due without undue delay and, where feasible, within 72 hours of awareness.”

Manuel B. Garcia

per affected resident lawsuit under the Confidentiality of Medical Information Act

“The Confidentiality of Medical Information Act also permits affected residents to sue, with statutory minimum damages of $1,000 even without proof of actual harm.”

ShieldForce