Indiana Breach Notification Timelines for Ambulatory Surgery Centers: Deadlines and Requirements

Breach Definition in Ambulatory Surgery Centers

Under Indiana law, a breach is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. For ambulatory surgery centers (ASCs), this typically means any incident—such as a hacking event, misdirected mailing, or lost device—that results in a personal information compromise affecting Indiana residents. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-2/section-24-4-9-2-2/))

Indiana’s notification duty is triggered when you know, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud. This “risk of harm” standard is central to deciding if notifications are required. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-1/))

“Personal information” generally covers an unencrypted Social Security number, or a person’s name combined with specific data elements like a driver’s license number or financial account credentials. While this definition is narrower than HIPAA’s “protected health information,” your ASC may handle records that include both, requiring you to evaluate state and federal rules in parallel. ([codes.findlaw.com](https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-2-10/?utm_source=openai))

Notification Deadline Requirements

Indiana imposes a firm notification deadline: you must provide required notices without unreasonable delay and no later than 45 days after discovering the breach. Treat day 0 as the date of discovery and build your response plan backward from that notification deadline. ([law.justia.com](https://law.justia.com/codes/indiana/2024/title-24/article-4-9/chapter-3/section-24-4-9-3-3/))

Because ASCs are HIPAA covered entities, you must also meet HIPAA’s “without unreasonable delay” and 60-day outer limit for breaches of unsecured PHI. In practice, you should follow the shortest applicable timeline—45 days under Indiana—while still satisfying HIPAA’s content requirements. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html?utm_source=openai))

Permitted Delays for Notification

Indiana recognizes limited reasons to delay notice. A delay is considered reasonable if it is necessary to restore system integrity, necessary to determine the scope of the incident, or made at the request of law enforcement or the Attorney General because disclosure would impede an investigation or jeopardize national security. Once those conditions end, you must notify as soon as possible. ([law.justia.com](https://law.justia.com/codes/indiana/2024/title-24/article-4-9/chapter-3/section-24-4-9-3-3/))

Document any law enforcement delay in writing, track the status at set intervals, and be prepared to resume your notification workflow immediately when the hold is lifted. This preserves your ability to demonstrate compliance if regulators later review your timeline for a potential law enforcement delay. ([law.justia.com](https://law.justia.com/codes/indiana/2024/title-24/article-4-9/chapter-3/section-24-4-9-3-3/))

Notification Methods and Procedures

Notices to affected individuals must be delivered by one of the following methods: mail, telephone, facsimile (fax), or electronic mail (if you have the person’s email address). Choose the channel you can verify and that will reliably reach the resident; retain delivery evidence for your compliance file. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-4/))

If your ASC must notify more than 1,000 Indiana residents, you are also required to notify each nationwide consumer reporting agency with information necessary to help prevent fraud. Coordinate this step alongside your resident notifications to keep your timeline on track. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-1/))

Substitute Notice Conditions

Indiana permits substitute notice if either of these thresholds is met: the cost of direct notice would exceed $250,000, or the affected class of Indiana residents is greater than 500,000. When you use substitute notice, you must conspicuously post the notice on your website (if you maintain one) and provide notice to major news reporting media in the geographic areas where affected residents live. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-4/))

Plan for substitute notice early by preparing web and media templates and by pre-identifying appropriate outlets. Even when using substitute notice, continue offering standard support options (e.g., call center, remediation steps) to help patients protect themselves. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-4/))

Reporting to Indiana Attorney General

Whenever you notify Indiana residents, you must also provide Attorney General notification. The Attorney General notification is subject to the same 45-day standard and should be sent as soon as practicable within that window. Keep copies of what you sent to residents because regulators often request a sample of the individual notice. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-1/))

In addition to notice obligations, Indiana authorizes enforcement by the Attorney General for violations of the statute’s data security and disposal duties. Maintain a written incident record, corrective actions, and timeline to demonstrate good-faith compliance if your ASC is ever reviewed. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-3-5/))

Encryption Safe Harbor Provisions

Indiana provides strong encryption safe harbors. Personal information that is properly encrypted or redacted does not trigger notification duties. Separately, the unauthorized acquisition of a portable electronic device is not a “breach” if all personal information on the device is encrypted and the encryption key has not been compromised or disclosed (encryption key protection is essential). ([codes.findlaw.com](https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-2-10/?utm_source=openai))

Encryption itself is defined by statute; it must transform data into a form with a low probability of assigning meaning without use of a confidential process or key. If an attacker accessed the encryption key, the safe harbor is lost and notification analysis restarts under the standard 45-day timeline. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-2/section-24-4-9-2-5/?utm_source=openai))

Conclusion

For Indiana ASCs, act fast, verify scope, and notify affected individuals, the Attorney General, and—when applicable—consumer reporting agencies within the state’s 45-day notification deadline. Align these steps with HIPAA’s requirements, leverage encryption to minimize exposure, and document every decision to show good-faith compliance. ([law.justia.com](https://law.justia.com/codes/indiana/2024/title-24/article-4-9/chapter-3/section-24-4-9-3-3/))

FAQs.

What is the notification deadline for a breach in Indiana?

You must notify without unreasonable delay and no later than 45 days after discovering the breach. If HIPAA applies, you must also meet HIPAA’s “no later than 60 days” rule; use the shorter (45-day) Indiana timeline to stay compliant with both. ([law.justia.com](https://law.justia.com/codes/indiana/2024/title-24/article-4-9/chapter-3/section-24-4-9-3-3/))

When can an ambulatory surgery center delay breach notification?

Indiana allows a reasonable law enforcement delay requested by the Attorney General or a law enforcement agency, and delays needed to restore system integrity or determine breach scope. Once the delay ends, send notices as soon as possible. ([law.justia.com](https://law.justia.com/codes/indiana/2024/title-24/article-4-9/chapter-3/section-24-4-9-3-3/))

How must notifications be sent to affected individuals?

Use one of the following: mail, telephone, fax, or email (if available). If more than 1,000 residents are affected, you must also notify nationwide consumer reporting agencies with information they need to help prevent fraud. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-4/))

When is substitute notice required?

Substitute notice is permitted if direct notice would cost more than $250,000 or the affected class exceeds 500,000 Indiana residents. It must include a conspicuous website posting and notice to major news media where affected residents live. ([law.justia.com](https://law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-24-4-9-3-4/))