When a breach may trigger notification obligations, the first job is to fix a discovery date, pull in legal counsel, and start the shortest statutory clock that could apply. State laws vary widely: some set numeric deadlines, while many use softer language like "without unreasonable delay." HIPAA caps notice at 60 days and the FTC Safeguards Rule gives certain financial institutions just 30 days to report larger incidents.
TL;DR:
- Federal and state obligations stack; state laws can add recipients, shorten deadlines, or require notice even when HIPAA or FTC reporting is complete.
- Trigger standards differ by state: some laws require proof of acquisition, while others treat unauthorized access or reasonably suspected acquisition as reportable.
- Encryption can exempt compromised data from notification in many states only when attackers did not obtain decryption keys; confirm each jurisdiction’s wording.
- Vendors processing data must promptly alert data owners after unauthorized access, so contracts should set a notice window that leaves time to meet statutory deadlines.
- HIPAA breaches affecting 500 or more individuals require prompt HHS reporting, while smaller incidents can be included in an annual filing.
Table of Contents
- How federal breach rules and state statutes fit together
- Who is covered and what counts as a reportable event
- Timelines and deadlines: numeric limits versus "without unreasonable delay"
- Who you have to notify, and the thresholds that add more recipients
- What a compliant notice actually has to say
- A step-by-step incident response checklist for the first weeks
- Coordinating with law enforcement when notification needs to wait
- Practical priorities for U.S. organizations responding to a breach
- How Nexus can help with incident response and breach notification compliance
- FAQ
- Sources
How federal breach rules and state statutes fit together
Most U.S. organizations face at least two layers of breach notification law at once, and the layers do not always agree on timing or recipients. Figuring out which ones apply, and in what order, is the real first task after containment.
If your organization is a HIPAA covered entity or business associate, the Breach Notification Rule sets the floor. It requires notice to affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery. Covered entities also owe a report to the HHS Secretary, though the mechanics differ depending on scale: breaches affecting 500 or more individuals require prompt reporting, while smaller breaches can be bundled into an annual filing.
A separate federal track applies to financial institutions. The FTC's amended Safeguards Rule, in effect since May 2024, requires covered financial institutions to report "notification events" affecting 500 or more consumers to the FTC as soon as possible, and no later than 30 days after discovery. That 30-day window is tighter than HIPAA's and applies to a different population of businesses, so confusing the two regimes is an easy way to miss a deadline. FTC guidance on the Safeguards Rule also explains that reports filed through the online form may become public or subject to a Freedom of Information Act request, which is worth knowing before you draft one.
There's a third federal track for health data that falls outside HIPAA. Vendors of personal health records and related non-HIPAA entities fall under the FTC's Health Breach Notification Rule, which uses the same "without unreasonable delay" language and has historically set a 60-day outer limit for consumer notice, plus media notice obligations for large incidents.
Layered on top of all three federal regimes are state and District of Columbia breach notification statutes. State law is not preempted by HIPAA or the FTC rules: it's an independent obligation that can add recipients, shorten timelines, or require content that federal law does not mention. A business that satisfies HIPAA but ignores a state attorney general notice requirement, or a hospital system that reports to HHS but forgets a state's 45-day consumer notice clock, is still out of compliance. The practical approach is to treat state law as the default baseline that always applies, then check which federal rule, if any, stacks on top of it based on your sector and the data involved.
Organizations building or refining cloud environments around protected health information often find it easier to bake these distinctions into technical controls from the start. Our guide on HIPAA compliant cloud infrastructure walks through how that separation works in practice.
Who is covered and what counts as a reportable event
Not every security incident is a notifiable breach, and not every organization is covered by every statute. Sorting this out quickly prevents both under-reporting and the wasted effort of over-notifying on an event that doesn't legally require it.
Coverage under U.S. breach laws typically extends to private businesses, government entities, data brokers, HIPAA covered entities and their business associates, and, under the Safeguards Rule, certain financial institutions. HHS guidance makes clear that business associates share the obligation alongside covered entities, not just the organizations that hold the direct patient relationship.
What actually triggers notice depends on the statutory language, and that language is not uniform:
- Some statutes use "unauthorized acquisition" as the trigger, meaning the data must actually have been taken, not just exposed.
- Others use "unauthorized access," a lower bar that can be met even without proof the data left the system.
- Many statutes use "reasonably believed to have been acquired," which shifts the test toward a risk assessment rather than certainty.
Because the trigger language differs state by state, the same incident can be a reportable breach in one jurisdiction and a non-event in another. This is one reason a single internal incident response playbook has to be flexible enough to apply different legal tests to the same facts.
Encryption changes the calculus in most states. If the compromised data was encrypted and the attacker did not also obtain the decryption keys, many statutes treat the incident as exempt from notification, often called a safe harbour provision. The exact wording of the exemption varies by state, so this is worth confirming rather than assuming. Strong encryption practices also reduce the odds of triggering notice in the first place. Our breakdown of patient data encryption practices covers the technical controls that support this kind of safe harbour position for healthcare organizations specifically.
Third-party processors carry their own duty in most frameworks: a vendor that discovers unauthorized access to data it processes on your behalf typically must notify you, the data owner, promptly, so that your statutory clock can start running on time. If your vendor contracts don't specify a notice window for the vendor to flag you, that's a gap worth closing before an incident forces the issue.
Timelines and deadlines: numeric limits versus "without unreasonable delay"
The single most consequential fact to establish after any incident is the discovery date, because every statutory clock, state or federal, starts counting from that point. Investigative time counts toward the deadline. An organization that spends three weeks confirming the scope of a breach before even consulting counsel has already burned three weeks of whatever window applies.
State breach laws split into two camps on timing. A minority, roughly 39% of states, specify a numeric deadline. The remaining majority rely on qualitative standards such as "without unreasonable delay" or "as expediently as possible," which give more flexibility but also more ambiguity about what counts as timely.
Federal timelines layer on top of whichever state clock applies:
- HIPAA requires notice to individuals without unreasonable delay and in no case later than 60 calendar days after discovery, per the Breach Notification Rule.
- The FTC Safeguards Rule requires covered financial institutions to report notification events affecting 500 or more consumers to the FTC as soon as possible, and no later than 30 days after discovery, under the rule explained in FTC guidance.
- State deadlines and the point at which the clock starts can differ from federal standards.
When an incident touches multiple jurisdictions or multiple regulatory regimes at once, the safest operating assumption is that the shortest applicable window governs your internal timeline, even if you intend to argue for a longer one later. Missing a financial institution deadline because you were tracking HIPAA's longer window is the kind of error that turns a security incident into a regulatory one.
A practical consequence of this rule of thumb: build your internal incident response timeline around the tightest deadline on the table, then treat every other deadline as already satisfied once you hit that mark. Trying to calculate separate timelines for every statute in play, in the middle of an active incident, is how organizations miss windows they could have met with a single, conservative internal deadline.
Who you have to notify, and the thresholds that add more recipients
Breach notification duties rarely stop at the people whose data was exposed. Depending on the scale of the incident and your sector, you may owe notice to a state regulator, a federal agency, or even the media.
Individual notice to affected people is required by essentially every state statute and by HIPAA. When contact information is incomplete or outdated, most frameworks allow substitute notice instead, typically a conspicuous web posting or notice through major media, as described in the HIPAA notification rules that govern how covered entities handle incomplete contact lists.
State attorneys general or a designated state agency are the next common recipient. Many states require this notice once an incident crosses a defined threshold, though the threshold and the agency designated to receive it differ by state. This is one of the areas where a state-by-state reference chart earns its keep, because assuming a single national threshold is a common and costly mistake.
Federal agency notice follows its own rules depending on sector:
- HIPAA covered entities must notify the HHS Secretary for breaches affecting 500 or more individuals without unreasonable delay and no later than 60 days, using the process described in HHS's breach reporting guidance.
- Financial institutions covered by the Safeguards Rule report notification events to the FTC through the online form referenced in FTC Safeguards Rule guidance, and the FTC may publish aggregate or individual reporting data.
Media notice is its own category in several states, triggered independently of the state AG threshold when a large enough number of residents in that state are affected. The precise number varies, so this is one more figure to confirm against the specific state statute rather than assume carries over from a neighbouring jurisdiction.
What a compliant notice actually has to say
Getting the recipients and the timing right doesn't help if the notice itself is missing required content. Most U.S. statutes and federal rules converge on a similar core set of elements, even though the exact wording and formatting rules differ.
At minimum, a compliant notice commonly needs to include the date or an estimated date range of the breach, a description of the categories of personal information involved, a brief account of what the organization has done to investigate and contain the incident, concrete steps individuals can take to protect themselves, and contact information for follow-up questions. These elements line up closely with what eCFR Title 45 specifies for HIPAA notices and what state statutes typically expect as well.
HIPAA adds a few specific mechanics on top of that baseline. Notices must be written in plain language, and for substitute notice involving ten or more individuals whose contact information is insufficient, covered entities must post a notice on their website for 90 days and provide a toll-free number, per the same eCFR provision. HHS's reporting guidance also lays out exactly how the Secretary notification should be submitted and when, separate from the individual notice requirement.
Some states go further on format, not just content. A handful of states expect notices to be structured under specific headings, such as a section answering "What Happened?" followed by one answering "What We Are Doing," rather than free-form prose. A notice that contains all the right facts but skips the required structure can still fail to satisfy the statute, so it's worth checking format requirements alongside content requirements rather than assuming one covers the other.
A number of states also require offering credit monitoring or identity theft protection services when certain types of data, usually Social Security numbers or financial account numbers, are involved. The trigger for this obligation and the duration of coverage required varies by state, so this is a detail to confirm against the specific jurisdictions where affected individuals reside rather than apply uniformly.
A step-by-step incident response checklist for the first weeks
Legal requirements only matter if your organization can execute them under pressure. A clear, role-based checklist turns the rules above into something a response team can actually follow during the first hours, days, and weeks of an incident.
- At discovery: contain affected systems, preserve logs and forensic evidence before anything is overwritten, record the exact discovery date and time, and notify internal leadership along with legal counsel immediately.
- During the initial response: scope the incident to determine what data and how many individuals were affected, check whether encryption or another statutory exception applies, notify any third-party vendors whose systems or data were involved, and begin drafting individual and regulator notices in parallel.
- Within the shortest applicable statutory window: finalize and send individual notices, submit notice to state attorneys general or designated agencies where a threshold is met, report to HHS or the FTC if the sector-specific rule applies, and publish substitute or media notice if a jurisdictional threshold requires it.
- Throughout the response: maintain a written log of every decision, every law enforcement contact, and proof of when each notice was sent, because this record becomes the evidence that your response was timely and in good faith.
Clear ownership matters as much as the timeline itself. IT and security teams own forensics and containment. Legal counsel owns statutory interpretation and any direct contact with regulators. Communications owns drafting plain-language notices that meet both the tone and content requirements described earlier. Vendor management owns coordinating with any third-party processor involved, including pulling confirmation of when that vendor discovered the issue on their end.
Pro Tip: Draft your notice templates and regulator contact lists before an incident happens, not during one. A breach is the worst time to be figuring out which state agency form to use.
Documentation deserves its own line item because it does double duty: it supports your compliance position if a regulator later asks why your timeline looked the way it did, and it gives your communications team a factual record to draw from when drafting notices days or weeks after the initial containment work. Teams that skip this step often find themselves reconstructing a timeline from memory under deadline pressure, which rarely goes well.
Organizations building a repeatable playbook rather than reacting fresh each time tend to fare better on both speed and accuracy. Our enterprise incident response checklist expands on the operational side of this process with templates for each role described above, and our guide to ransomware incident response covers the specific containment steps that matter most in the opening hours of that particular type of incident.
Coordinating with law enforcement when notification needs to wait
There is one narrow, well-recognized exception to every deadline described so far: a law enforcement agency can ask you to delay notification when early disclosure would interfere with a criminal investigation. This exception exists in many state statutes and in federal guidance, but it is not a blanket excuse to slow down on your own judgment.
The request needs to come from the agency itself, ideally in writing, and your organization should keep a dated log of exactly what was requested and by whom. If the agency communicates verbally first, follow up in writing to confirm the request and the reason given, because that record is what demonstrates the delay was legitimate rather than a convenient excuse to miss a deadline.
Once law enforcement clears the way, the clock on your notification obligation generally resumes or gets recalculated from that clearance date, so the same log needs to capture exactly when that happened. Without that documentation, a regulator reviewing your response later has no way to distinguish a lawful, requested delay from a simple failure to notify on time.
When this situation comes up, the safest move is to loop in legal counsel immediately and use the relevant agency's own reporting channel, whether that's a state attorney general's breach notification form, the HHS breach reporting portal, or the FTC's online form for Safeguards Rule events, rather than guessing at the right process mid-incident.
Practical priorities for U.S. organizations responding to a breach
The single most important decision in any breach response is also the simplest to get wrong: pinning down the discovery date and assembling legal and technical teams immediately. That one step defines every deadline that follows, federal and state alike.
Notification itself is an incident response activity, not a separate legal afterthought. Organizations with clear roles and pre-built notice templates move faster and take on less legal exposure than those improvising under pressure. Documentation of every decision, every regulator contact, and every notice sent often matters as much, in a later review, as the notice itself.
— Nick - Sr. Executive
How Nexus can help with incident response and breach notification compliance
Responding to a breach while simultaneously tracking federal rules, state statutes, and regulator-specific forms is a lot to manage with an internal team that handles security as one of many responsibilities. We built our incident response and compliance services around exactly that gap.
Our team provides:
- Threat detection and monitoring paired with hands-on incident response and forensic support when an event occurs.
- Compliance assessments covering HIPAA, PCI-DSS, ISO 27001, and SOC 2, so your controls and documentation hold up under regulator review.
Working with one consolidated provider removes a lot of the coordination friction that slows down a breach response when forensics, legal interpretation, and regulator contact are split across separate vendors. Our model keeps containment and compliance assessment under a single point of accountability. If your organization wants a response partner in place before the next incident rather than during it, our services page outlines how engagements work.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
Can I claim against a data breach?
Whether you can bring a legal claim depends on the specific facts, applicable state law, and whether you suffered demonstrable harm, so this is a question for a qualified attorney rather than a general rule. Organizations responding to a breach should focus on meeting their own notification obligations rather than anticipating any particular claim outcome.
Is there a US data privacy law?
There is no single comprehensive federal privacy law covering all data types; instead, the U.S. relies on sector-specific federal rules, such as HIPAA for health data and the FTC's Safeguards Rule for financial institutions, layered with separate breach notification statutes in each state. Businesses typically need to check both the federal rule for their sector and the state law for each jurisdiction where affected individuals live.
Do all 50 states have data breach notification laws?
Yes, all states along with the District of Columbia have their own breach notification statutes, though the triggers, deadlines, and required recipients differ significantly from state to state. Some states set a numeric deadline while most rely on a "without unreasonable delay" standard, as reflected in HHS's breach notification guidance.
Does HIPAA have a breach notification rule?
Yes, HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Covered entities must also report the breach to the HHS Secretary, with reporting mechanics that depend on whether 500 or more individuals were affected.
Sources
Consult HHS's HIPAA breach guidance, FTC Safeguards Rule guidance, and a current state-by-state statutory chart before finalizing any notice.