West Virginia Healthcare Data Breach Notification Law: Requirements and Deadlines

Covered Entities and Scope

West Virginia’s breach notification law applies to any individual or entity—public or private—that owns or licenses computerized data containing personal information of West Virginia residents. Healthcare providers, health plans, business associates, and their vendors are covered when they hold such computerized data. “Good-faith” access by an employee or agent is not a personal information breach if the data is not misused or further disclosed. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

If you maintain, process, or store personal information on behalf of another organization, you must notify the data owner or licensee as soon as practicable after discovering a breach. Entities with written breach procedures that align with the statute’s timing requirements, or that follow the rules of a primary or functional regulator (for example, sector-specific federal rules for healthcare), are deemed compliant when they follow those procedures. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-102/))

Definition of Personal Information

Personal information means a West Virginia resident’s first name or initial and last name in combination with one or more of the following unencrypted and unredacted data elements: Social Security number; driver’s license or state ID number; or financial account, credit card, or debit card number with any required code or password that permits account access. Publicly available information is excluded. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

Healthcare-specific data elements (for example, diagnosis codes or medical record numbers) are not listed in West Virginia’s definition. However, a healthcare organization may still have separate federal obligations when protected health information is involved. The state definition matters for state-law notice duties tied to computerized data. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

Timing and Methods of Notification

Notify affected West Virginia residents “without unreasonable delay” after discovering or being notified of a qualifying breach, allowing time to determine scope, restore system integrity, and to accommodate any law enforcement request for delay. If law enforcement advises that notice would impede an investigation or threaten security, you must wait until that restriction is lifted and then notify without unreasonable delay. These notification deadlines apply to a personal information breach involving computerized data. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-102/))

Permitted methods include written notice, telephonic notice, or electronic notice consistent with the federal E-SIGN Act. An encryption exemption exists: if data was encrypted, notice is generally not required unless the information was accessed in unencrypted form or the attacker had the encryption key, and you reasonably believe identity theft or fraud has occurred or will occur. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

Substitute Notice Conditions

Substitute notice is allowed when direct individual notice is impracticable because: the cost would exceed $50,000; the affected class of residents exceeds 100,000 people; or you lack sufficient contact information. Substitute notice must use any two of these methods: email (if available), conspicuous website posting, and notice to major statewide media. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

Notification Content Requirements

Your notice to individuals must, to the extent possible, include: a description of the categories of information reasonably believed to have been accessed or acquired; a phone number or website where people can learn what types of information you maintain and whether you maintain information about them; and the toll‑free numbers and addresses of the major consumer reporting agencies with instructions on placing a fraud alert or security freeze. These items are mandatory content elements under West Virginia law. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-102/))

Credit Reporting Agencies Notification

If you must notify more than 1,000 persons, you must also notify the nationwide consumer reporting agencies “without unreasonable delay” and provide the timing, distribution, and content of your notices. You should not include the names or other personal identifiers of affected individuals. This CRA notification requirement does not apply to entities subject to Title V of the Gramm–Leach–Bliley Act. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-102/))

Enforcement and Penalties

Failure to comply with West Virginia’s breach notice provisions is an unfair or deceptive act or practice enforceable by the Attorney General. The Attorney General has exclusive authority to bring actions under this article; there is no private right of action under the state breach notification statute. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-104/))

Civil penalties may be imposed only for repeated and willful violations, and they are capped at $150,000 per breach or series of similar breaches found in a single investigation. For licensed financial institutions, enforcement lies exclusively with their primary functional regulator. These civil penalties underscore the importance of timely, complete notifications and defensible decision-making. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-104/))

FAQs

What entities are covered under the West Virginia healthcare data breach notification law?

Any individual or entity that owns or licenses computerized data with personal information of West Virginia residents is covered, including healthcare providers, health plans, and business associates. Those that maintain data for others must notify the owner or licensee when a breach is discovered. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

How soon must affected individuals be notified after a breach?

You must notify affected residents without unreasonable delay after discovery, factoring in actions needed to determine scope, restore system integrity, and any temporary delay requested by law enforcement. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-102/))

When is substitute notice permitted?

Substitute notice is permitted when the cost of direct notice would exceed $50,000, more than 100,000 residents must be notified, or you lack sufficient contact information. It must use any two of: email (if available), a conspicuous website posting, and statewide media notice. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-101/))

What penalties apply for non-compliance?

Non-compliance is an unfair or deceptive act or practice enforceable by the Attorney General. Civil penalties for repeated and willful violations can be assessed up to $150,000 per breach or series of similar breaches in a single investigation; financial institutions are enforced by their functional regulator. ([code.wvlegislature.gov](https://code.wvlegislature.gov/46A-2A-104/))