Data Breach Notification Laws Flashcards

Which US federal law requires covered entities to notify individuals of breaches involving unsecured protected health information?

Answer: HITECH Act

The HITECH Act established the HIPAA Breach Notification Rule requiring covered entities to notify affected individuals, HHS, and sometimes the media of PHI breaches.

Under most US state breach notification laws, what triggers the notification obligation?

Answer: Unauthorized acquisition of personal information

Notification is typically triggered when personal information is acquired by an unauthorized person, not merely accessed or viewed.

Which state enacted the first US data breach notification law in 2003?

Answer: California

California's SB 1386, effective in 2003, was the first state data breach notification law and served as a model for other states.

The SEC requires publicly traded companies to disclose material cybersecurity incidents within how many business days?

Answer: 4 business days

The SEC's 2023 cybersecurity rules require public companies to file Form 8-K disclosing material incidents within four business days of determining materiality.

Which element is commonly required in a breach notification letter to consumers?

Answer: Description of the type of information involved

State breach notification laws typically require the letter to describe the type of personal information that was involved in the breach.

Under the HIPAA Breach Notification Rule, large breaches affecting 500 or more individuals must be reported to HHS within what timeframe?

Answer: 60 days of discovery

Covered entities must notify HHS of breaches affecting 500 or more residents of a state or jurisdiction within 60 days of discovery.