State breach notification deadlines

HIPAA gives a covered entity up to 60 days to notify individuals after a breach, and that figure gets repeated often enough that it starts to sound like the answer. It is not the whole answer. HIPAA’s 60 days is a federal floor, and states are free to set their own, faster clock, their own regulator notice duty, or both, on top of it.

This page is the running, verified table behind that claim. Each row is checked against the actual statute, the legislature’s own site or the state’s official code, not a compliance vendor’s chart or a search summary. States that have not been checked yet are marked that way, with no deadline or threshold guessed in their place. The table grows as more states are verified; nothing here should be read as a claim about a state that is not yet in it. For the preemption logic behind why a state can require more than HIPAA in the first place, see the cluster hub. For HIPAA’s own federal breach rule in full, see the Breach Notification Rule.

Notes on specific states

Louisiana. The statute itself sets no standing duty to notify the Attorney General of a reportable breach. Whether a separate administrative rule imposes one has not been verified from a primary source and is not stated as fact here; confirm directly with counsel before relying on either the presence or the absence of a state-level filing duty.

Alaska. The chapter that covers breach notification defines personal information without a medical or health category. A different part of the same chapter, the one covering records disposal, defines personal information more broadly and does include medical information. They are easy to conflate; only the breach-notification definition controls whether a given data element triggers this statute’s notice duty.

Connecticut. An entity already following HIPAA and HITECH’s own breach rules is deemed compliant with Connecticut’s section as a whole, which sounds like a full exemption. It is not quite one: that same provision still requires the entity to notify the Connecticut Attorney General at the same time it notifies residents, and to offer identity theft prevention services where the statute would otherwise require it.

Montana. The Attorney General notice duty here is easy to miss on a first read, because the statute refers to the attorney general’s consumer protection office in lowercase, in its own subsection, rather than in the capitalized phrasing most other states use. It applies to every notification issued under the section, with no resident-count threshold.

South Dakota. Rather than write its own definition of medical or health information, South Dakota’s statute incorporates the federal HIPAA regulatory definition by reference, 45 CFR 160.103. The practical effect is the same as a state that wrote its own medical information category.

District of Columbia. The 50-resident threshold for notifying the DC Attorney General is the lowest regulator-notice threshold found so far, well below the 250 to 1,000 resident thresholds that are more typical elsewhere.

Florida. A covered entity that follows the breach rules of its own primary or functional federal regulator, such as HHS for a HIPAA-covered entity, is deemed to have satisfied the individual-notice duty, and sending the state a copy of that same notice also satisfies the separate duty to notify the Department of Legal Affairs. The statute never names HIPAA directly; it reaches a HIPAA-covered entity only because HHS counts as that entity’s primary federal regulator.

“HIPAA gives you up to 60 days. Several states give you less, and some want the regulator told before you have told anyone else”

Maryland. The exemptions live in a separate section from the notice duty itself, section 14-3507, not the section that sets the deadline and the Attorney General notice duty, section 14-3504. A HIPAA-covered entity reading only the notice-duty section would miss that it is fully exempt.

Generic regulator clauses (Florida, Kansas, Maryland, Missouri, Utah, Virginia). Several states deem an entity compliant with their breach statute if it follows the rules of its own primary or functional federal or state regulator, without ever naming HIPAA. For a HIPAA-covered entity, that regulator is HHS, so the clause functionally reaches it even though the statute’s text does not say so. Most of these clauses carry no carve-out, meaning they relieve the entity of the regulator-notice duty too, not just individual notice, unlike the explicit-HIPAA states above that often preserve the regulator-notice duty on purpose.

Vermont. The HIPAA carve-out here is narrower than in most other states: it applies only when the breach is limited to the health-information category in the state’s own personal-information definition. A breach that also exposes another category in the same incident, a Social Security number alongside the health records, for example, would not be covered by this carve-out.

Virginia. A separate statute, section 32.1-127.1:05, covers breaches of medical information specifically and adds the Commissioner of Health as a required recipient alongside the Attorney General. Two things narrow how often this actually applies to an ABA clinic: the statute’s own definition of a covered entity is limited to government bodies and organizations supported mainly by public funds, not private businesses generally, and it separately exempts HIPAA covered entities and business associates outright. A clinic that is a HIPAA covered entity is outside this statute’s scope twice over, but the existence of a parallel medical-information statute with its own extra regulator is worth knowing.

Wyoming. The statute’s own list of data elements for personal identifying information was repealed in 2015 and replaced with a cross-reference to a different title’s criminal identity-theft statute, W.S. 6-3-901(b)(iii) through (xiv). That cross-referenced list was not available to check in this pass, so whether it names medical or health information is not confirmed either way.

What to do first

Start with a list, not a conclusion: every state where the clinic has a location, a telehealth client sitting in that state during a session, or staff working from that state. A clinic’s own state is rarely the only one that matters, and the state that actually controls a given incident is usually the state the affected individual lives in, not the state the clinic is based in.

Then take that list, and this table, to counsel licensed in each state on it, and confirm the current rule before it is needed, not during an incident. This page is educational. It does not establish that a clinic is compliant with any state’s law, and a verified row here is not a substitute for a state-licensed opinion on a live incident.