Data breach reporting requirements in the United States run on deadlines as short as 36 hours under federal banking rules and as long as 60 days under most state and healthcare statutes. There is no single national breach law. Instead, every state, the District of Columbia, and the major territories have their own notification statutes, and federal rules layer additional obligations on top for healthcare entities, financial institutions, public companies, and critical infrastructure operators. Which rules apply to a given incident depends on the type of data involved, the industry you operate in, and where the affected individuals live.
What Counts as a Reportable Breach
Not every security incident triggers a legal duty to notify anyone. A reportable breach generally involves unauthorized access to or acquisition of unencrypted personal information that creates a real risk of harm. The common thread across state and federal law is a person’s name combined with at least one other sensitive identifier: a Social Security number, driver’s license number, or financial account number with an access code or password.
Many state laws have expanded that list to include biometric data, health insurance information, username-and-password combinations, and taxpayer identification numbers. Under HIPAA, the trigger is any unauthorized access to protected health information that has not been rendered unusable through encryption or destruction. A blocked phishing attempt or a port scan that never compromises data typically falls below the reporting threshold, though you still need to document the investigation that led to that conclusion.
Federal Deadlines by Industry
Federal breach reporting obligations are industry-specific. An organization that fits into more than one category may owe separate reports to separate agencies on separate clocks.
HIPAA: 60 Days for Health Information
Healthcare providers, health plans, healthcare clearinghouses, and their business associates must report breaches of unsecured protected health information. “Unsecured” means the data was not encrypted or destroyed using methods specified by HHS guidance.
Individual notifications must go out within 60 days of discovery regardless of breach size. If 500 or more individuals are affected, the covered entity must also notify the Secretary of HHS without unreasonable delay and no later than 60 calendar days after discovery, plus prominent media outlets in the state or jurisdiction where affected individuals live. Breaches involving fewer than 500 people can be batched and reported to HHS within 60 days after the end of the calendar year in which they were discovered.1U.S. Department of Health and Human Services. Submitting Notice of a Breach to the Secretary
Banking Regulators: 36 Hours
Banks, savings associations, and other depository institutions supervised by the OCC, FDIC, or Federal Reserve operate under one of the tightest deadlines in U.S. law. They must notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a “notification incident” has occurred. A notification incident is a computer-security incident that has materially disrupted or is reasonably likely to materially disrupt banking operations, a significant business line, or operations whose failure could threaten financial stability.2FDIC. Computer-Security Incident Notification Final Rule
The 36-hour clock starts when the organization determines a notification incident has occurred, not when the investigation wraps up. The same rule requires bank service providers to notify affected banking customers as soon as possible after an incident that could materially disrupt the banking services they provide.3eCFR. 12 CFR Part 53 – Computer-Security Incident Notification
FTC Safeguards Rule: 30 Days
Non-bank financial institutions fall under the FTC’s Safeguards Rule, which implements the Gramm-Leach-Bliley Act. These entities must notify the FTC as soon as possible and no later than 30 days after discovering a breach involving the unencrypted information of at least 500 consumers. The rule treats data as unencrypted if the encryption key was compromised along with it, and it treats unauthorized access to unencrypted customer information as unauthorized acquisition unless reliable evidence shows otherwise.4Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
FTC Health Breach Notification Rule
Health apps, fitness trackers, and other vendors of personal health records that fall outside HIPAA are covered by the FTC’s Health Breach Notification Rule. A breach of unsecured health information requires notice to affected consumers, the FTC, and in some cases the media. Breaches affecting 500 or more people require notice to the FTC within 60 days and media notification in the affected area. Smaller breaches must be reported to the FTC within 60 days after the end of the calendar year.5Federal Trade Commission. Health Breach Notification Rule
SEC: Four Business Days for Public Companies
Publicly traded companies must file a Form 8-K under Item 1.05 within four business days of determining that a cybersecurity incident is material. The filing must describe the nature, scope, and timing of the incident and its material or reasonably likely material impact on the company’s financial condition and operations.6U.S. Securities and Exchange Commission. Form 8-K
The materiality determination itself must happen without unreasonable delay after discovery, so a company cannot run out the clock by deferring the assessment. If information is missing at the time of filing, the company must say so and then amend the 8-K within four business days once the information is determined. The only basis for delaying the initial filing is a written determination from the U.S. Attorney General that disclosure would pose a substantial risk to national security or public safety.7U.S. Securities and Exchange Commission. Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
CIRCIA: Not Yet in Effect
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 directs CISA to write regulations requiring critical infrastructure operators to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. The law covers 16 critical infrastructure sectors, including energy, healthcare, financial services, water systems, transportation, communications, and information technology.8CISA. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
As of early 2026, CISA is still finalizing the implementing regulations. The proposed rule was published in April 2024, and CISA has acknowledged that federal appropriations lapses will likely delay the final rule. Until the final rule takes effect, organizations are not legally required to submit incident or ransom payment reports under CIRCIA, though many are already subject to sector-specific reporting requirements administered by other agencies.
State Notification Laws
All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have enacted breach notification laws. These state statutes are the primary mechanism driving direct notice to affected consumers, and they often demand more than federal law does.
Jurisdiction generally follows the resident, not the company. A business headquartered in one state that loses records for residents of 30 other states has to comply with the notification law in each of those states. Most organizations respond by aligning their process to the most restrictive applicable law.
State statutes typically define personal information more broadly than federal law. Beyond name plus Social Security or financial account number, many states now cover biometric identifiers, medical information outside HIPAA’s scope, taxpayer identification numbers, passport numbers, and login credentials. Incidents that trigger no federal reporting obligation can still require state-level notice.
Most state laws require notice to the state attorney general or a designated consumer protection agency in addition to affected individuals. Some states require AG notice regardless of the number of residents affected; others set thresholds that typically range from 250 to 1,000 individuals. Deadlines generally fall between 30 and 60 days from discovery, with many states using language requiring notice “without unreasonable delay” and setting an outer limit.
When Notification Is Not Required or Can Be Delayed
Encryption
Every state breach notification law includes a provision that notice is not required if the compromised data was encrypted. Some states explicitly add that the safe harbor only applies if the encryption key itself was not compromised. The FTC’s Safeguards Rule takes the same approach, treating encrypted data as unencrypted for notification purposes when the key was also accessed.4Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
Under HIPAA, the Breach Notification Rule applies only to “unsecured” PHI. HHS has published guidance specifying that PHI is considered secured if it has been encrypted using processes consistent with NIST standards or if the media on which it was stored has been destroyed.9U.S. Department of Health and Human Services. Breach Notification Rule
Law Enforcement Delay
Federal and state laws generally allow a delay when a law enforcement agency determines that immediate disclosure would impede a criminal investigation or compromise national security. The delay typically requires a written request from the agency. Once the hold is lifted, notifications must go out promptly, often within 30 days. The exception postpones the obligation; it does not eliminate it.
HIPAA Good-Faith Exception
HIPAA recognizes that not every accidental exposure of health information is a reportable breach. If an employee unintentionally accesses PHI in good faith while performing their job duties and does not further disclose it in a way the Privacy Rule prohibits, the incident is not treated as a breach. The access must be within the employee’s scope of authority, unintentional, and not shared inappropriately. If any of those conditions fails, the exception does not apply.
What a Breach Notice Must Say
Content requirements are remarkably consistent across jurisdictions. Under HIPAA, individual notifications must include a description of what happened and the dates involved, the types of information compromised, steps the individual should take to protect themselves, what the organization is doing to investigate and prevent further breaches, and contact information including a toll-free phone number that stays active for at least 90 days.10eCFR. 45 CFR 164.404 – Notification to Individuals
State laws follow a similar pattern. Most require a description of the incident, the categories of data involved, and contact information. Many also require the notice to include information about placing a fraud alert or credit freeze, and a growing number require organizations to offer complimentary credit monitoring for a set period. HIPAA goes further by explicitly requiring plain language.
When an organization cannot reach affected individuals through standard channels because of outdated contact information or prohibitive cost, most state laws provide for substitute notice, which typically combines a prominent posting on the organization’s website with notice to major statewide media.
Penalties for Missing a Deadline
Failing to report on time, or failing to report at all, can cost more than the breach itself.
HIPAA penalties are structured in four tiers based on culpability. For violations where the entity was unaware and could not reasonably have known, penalties start at $145 per violation. Reasonable cause without willful neglect starts at $1,461. Willful neglect corrected within 30 days carries a minimum of $14,602 per violation. Willful neglect that goes uncorrected starts at $73,011 per violation, with an annual cap of $2,190,294 per violation category. These amounts adjust annually for inflation.9U.S. Department of Health and Human Services. Breach Notification Rule
For violations of the FTC’s rules, including the Health Breach Notification Rule and the Safeguards Rule, the inflation-adjusted civil penalty is $53,088 per violation as of 2025. Each affected consumer and each day of non-compliance can constitute a separate violation, so totals accumulate quickly.11Federal Register. Adjustments to Civil Penalty Amounts
State penalties vary widely. Some states authorize the attorney general to seek civil penalties ranging from several hundred to several thousand dollars per affected individual per violation. A number of states also provide a private right of action, letting affected consumers sue directly for statutory damages. In states that combine AG enforcement with private lawsuits, a single breach can produce regulatory fines, class-action settlements, and court-ordered injunctions at once.