Which U.S. States Have Breach Notification Deadlines Stricter Than HIPAA?

Overview of HIPAA Breach Notification Rule

The HIPAA breach notification rule requires covered entities and business associates to notify affected individuals of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after the breach discovery date. “Discovery” means the first day the incident is known—or should have been known with reasonable diligence—by the organization or its agents. You must also notify the U.S. Department of Health and Human Services (HHS), and for breaches affecting 500 or more residents of a single state or jurisdiction, notify prominent media outlets.

Business associates must alert the covered entity without unreasonable delay (no later than 60 days) and provide the information the covered entity needs to complete notices. Law enforcement can impose a temporary delay, but otherwise HIPAA does not permit extensions beyond the 60‑day cap. Because many state data breach laws set shorter notification deadlines, you should treat HIPAA’s 60 days as an outer bound and build your plan around the strictest applicable state rule.

States with 30-Day Notification Deadlines

As of September 3, 2026, these states require notifying affected residents within 30 days—stricter than HIPAA’s 60‑day limit. Each state uses its own trigger (for example, “discovery” or “determination” that a breach occurred), so read the statute’s timing language closely.

• Colorado — Notice to consumers no later than 30 days after determining a breach occurred; attorney general notification required when 500+ residents are affected. Third parties that maintain data on your behalf also have prompt pass‑through duties. Secondary requirements can include notifying nationwide consumer reporting agencies when 1,000+ residents are notified.
• Florida — Individual notice within 30 days of determining or having reason to believe a breach occurred; notice to the Department of Legal Affairs (attorney general) within 30 days if 500+ residents are affected. Third-party agents must inform the data owner within 10 days, and a limited 15‑day notification extension is available for good cause.
• Maine — Notice must be sent no more than 30 days after becoming aware of a breach and identifying its scope; processor-to-owner notice is required “immediately.” Law enforcement delay remains available.
• New York — A 30‑day maximum from discovery applies to notifying affected residents. Separate, contemporaneous regulator notifications are required to the state attorney general, Department of State, and State Police; notice to the Department of Financial Services is also required if you are a DFS‑covered entity. DFS’s cybersecurity regulation separately mandates 72‑hour reporting of certain cybersecurity events.
• Washington — Notice to residents no later than 30 days after discovery; attorney general notification within 30 days if 500+ residents are affected. Washington also prescribes specific content elements for consumer notices.

States with 45-Day Notification Deadlines

These states require consumer notification within 45 days—also stricter than HIPAA. Watch for state-specific harm thresholds, substitute notice rules, and regulator-reporting triggers.

• Alabama — 45 days from discovery or receipt of third‑party notice if the breach is reasonably likely to cause substantial harm.
• Arizona — 45 days from determination that a security breach occurred; AG notice procedures apply in higher‑impact incidents.
• Indiana — 45 days from discovery; coordination with the attorney general and consumer reporting agencies may be required depending on the scale.
• New Mexico — 45 days from discovery; AG and major consumer reporting agencies must be notified when 1,000+ residents are affected.
• Ohio — 45 days from discovery or notification; law enforcement delay permitted.
• Oregon — 45 days from discovery or receipt of third‑party notification; separate sector rules can add obligations.
• Rhode Island — 45 days after confirmation and once the required notice content can be ascertained; harm threshold applies.
• Tennessee — 45 days from discovery or notification; 10‑day pass‑through to owners applies for processors that do not own the data.
• Vermont — 45 days from discovery or notification; AG notice is often required earlier, and paper records may be covered.
• Wisconsin — Without unreasonable delay and no later than 45 days after learning of the breach.

Comparison of State and HIPAA Deadlines

HIPAA sets a 60‑day outer limit from breach discovery for notifying individuals about compromises of protected health information. In contrast, a growing group of state data breach laws impose 30‑ or 45‑day clocks measured from discovery or determination of a breach, making them stricter than HIPAA. You should therefore adopt the strictest applicable day count across the affected jurisdictions and treat that as your working deadline.

Timing triggers differ. Some states start the clock at “discovery,” while others start at “determination” or when law enforcement clears a previously imposed delay. Several states also layer in separate attorney general notification deadlines (for example, Florida and Washington at 30 days; Texas at 30 days for 250+ residents). Build your playbook to (1) record the breach discovery date, (2) track each state’s trigger language, and (3) launch regulator notifications on a parallel path with consumer notices to stay inside all applicable deadlines.

Specific Requirements in California and New York

California

California’s general breach statute requires notice “in the most expedient time possible and without unreasonable delay” rather than a fixed day count. It prescribes detailed content and formatting (plain language, mandated headings, and at least 10‑point type). If a single breach requires notice to more than 500 California residents, you must electronically submit a sample copy of the consumer notice to the California Attorney General within 15 calendar days after notifying consumers. Separate from the general statute, California’s Confidentiality of Medical Information Act requires certain licensed health facilities to notify patients no later than 15 business days after detecting an unauthorized access, use, or disclosure of medical information.

New York

New York requires notifying affected residents within 30 days of discovery. In all events where New York residents are notified, you must also notify the state attorney general, the Department of State, and the State Police; notice to the Department of Financial Services is required if you are a DFS‑covered entity. DFS’s cybersecurity regulation (23 NYCRR Part 500) separately requires covered financial institutions to report qualifying cybersecurity events to the Superintendent within 72 hours of determining that an event occurred, which often runs in parallel with the 30‑day consumer notice rule.

Notification Procedures in Florida and Texas

Florida

Florida’s Information Protection Act requires individual notice no later than 30 days after determining (or having reason to believe) a breach occurred. If 500 or more Florida residents are affected, you must also notify the Department of Legal Affairs (attorney general) within 30 days and share the consumer notice or an explanation of your actions. Processors must notify the data owner within 10 days of determining a breach, and a 15‑day extension of the consumer‑notice deadline is available for good cause. Civil penalties can reach up to $500,000 for prolonged noncompliance.

Texas

Texas requires individual notice without unreasonable delay and no later than 60 days after determining a breach occurred. However, if at least 250 Texas residents are affected, you must notify the Texas Attorney General as soon as practicable and no later than 30 days after determination, using the AG’s electronic breach form. When 10,000+ individuals are notified at one time, you must also notify the nationwide consumer reporting agencies of the timing, distribution, and content of your notices.

Implications for Healthcare Covered Entities

If you are a HIPAA covered entity or business associate, you must reconcile two frameworks: HIPAA’s 60‑day clock and stricter state data breach laws that can require 30‑ or 45‑day notices to state residents. In multi‑state incidents, plan to meet the shortest applicable deadline, then layer on regulator notifications (for example, Florida’s AG within 30 days; New York’s OAG/DOS/State Police concurrently; Texas AG within 30 days when 250+ residents are affected). Where a state offers a documented “good cause” extension (such as Florida’s 15 days), use it sparingly and keep written justification.

Operationally, lock in your breach discovery date, align your incident response runbook to state triggers, and ensure third‑party agreements mirror strict pass‑through timelines (e.g., Florida’s 10‑day rule). Remember that some states cover broader “personal information” than HIPAA’s protected health information; others recognize HIPAA‑compliant notices as satisfying state requirements while still requiring attorney general submissions. In practice, a 30‑day execution target—with earlier regulator alerts where required—gives you the best chance of staying compliant everywhere.

FAQs

Which states have shorter breach notification deadlines than HIPAA?

HIPAA’s outer limit is 60 days. States with 30‑day deadlines include Colorado, Florida, Maine, New York, and Washington. States with 45‑day deadlines include Alabama, Arizona, Indiana, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont, and Wisconsin. If your incident involves residents in any of these states, follow the strictest applicable clock.

How do state breach notification laws interact with HIPAA?

HIPAA sets a federal floor for notifying individuals about breaches of unsecured protected health information. State data breach laws apply in parallel and can be stricter or cover different data (for example, combinations of name plus other identifiers). If a state requires faster consumer notice or additional attorney general notification, you must satisfy those state obligations in addition to HIPAA. Several states deem entities compliant with state timing and content if they fully comply with HIPAA, but still require regulator submissions.

What are the penalties for missing state notification deadlines?

Penalties vary. Florida authorizes civil penalties up to $500,000 for extended noncompliance. Many states treat violations as unfair or deceptive acts, enabling attorney general enforcement, injunctions, and civil penalties. Some sectors (insurance/financial) face additional regulator consequences under sector‑specific cybersecurity rules. Reputational harm and class‑action exposure often dwarf statutory penalties, so timing discipline is critical.

Are there exceptions to the notification timelines in certain states?

Yes. Nearly all states permit a law enforcement delay if notification would impede an investigation. Some allow narrow extensions—Florida permits a 15‑day extension for good cause with notice to the Department of Legal Affairs. Many statutes also allow time to determine the breach’s scope and restore system integrity, provided you still meet the outer deadline (30 or 45 days, depending on the state). Always document the reason for any delay and maintain contemporaneous records of your timing decisions.