If a breach notice just arrived, the short answer is yes: companies that hold certain personal information generally must tell the people whose information was exposed. No single federal law covers every company. Health information falls under the HIPAA Breach Notification Rule, and state laws, such as California's, add their own duties, deadlines and required notice content.
Most people facing a breach notice are holding a letter that answers fewer questions than it raises. Was a Social Security number taken? Is a new account about to show up on a credit report? Did the company tell them in time, and what can they do now? This page explains who must send a notice, what it must say, and the credit-report rights that matter if exposed information is misused.
What Data Breach Notification Rights Mean
Under Cal. Civ. Code § 1798.82(g), a breach of the security of the system is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the business. A notification right is the affected person's legal entitlement to be told that it happened.
The framework is a patchwork. Federal law sets rules for particular sectors, and state law adds its own protections, which differ from state to state.
For health information, the HIPAA Breach Notification Rule requires HIPAA covered entities and their business associates to give notice after a breach of unsecured protected health information, according to the HHS Breach Notification Rule page. A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information in electronic form in connection with certain transactions. A business associate is a company that handles that information on its behalf.
The same HHS page says similar provisions, enforced by the Federal Trade Commission, apply to vendors of personal health records and their third-party service providers. In practical terms, a person whose health information was held by a vendor of personal health records, rather than by a doctor, hospital or health plan, may be covered by similar federal breach notification provisions that the FTC enforces. This page does not describe the details of those FTC provisions.
For other kinds of companies, state law may add its own protections, and it differs from state to state.
Federal Sector Rules: Who Must Notify and When
Under 45 C.F.R. § 164.404(b), a covered entity generally must notify each affected individual "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach," with a limited exception for law enforcement. A breach counts as discovered on the first day it is known, or would have been known through reasonable diligence, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity.
The HHS page adds further duties:
- Form of notice: written notice by first-class mail, or by email if the person agreed to electronic notices.
- Media notice: a breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area, within the same 60-day limit.
- Notice to HHS: a breach affecting 500 or more individuals must be reported to the Secretary without unreasonable delay and within 60 days; smaller breaches may be reported annually, no later than 60 days after the end of the calendar year in which they were discovered.
- Business associates: the covered entity stays ultimately responsible for notice, but may delegate it to the business associate.
A company covered by HIPAA may also face state notification duties.
State Breach Notification Laws: How They Differ
State breach notification laws differ from state to state.
California's rule shows what one state requires. Under Cal. Civ. Code § 1798.82(a), a business that conducts business in California and owns or licenses computerized personal information must notify a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Encrypted information triggers the duty too when the encryption key or security credential was also acquired and the business reasonably believes it could make the information readable or usable.
California's deadline is generally 30 calendar days after discovery or notification of the breach. That deadline is subject to delay for the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. When a law enforcement agency determines notice would impede a criminal investigation, notice may wait, then must go out promptly once the agency determines it will not compromise the investigation. For a reader comparing the date on a letter with the date of the breach, a notice that arrives after 30 days is not necessarily late; whether a permitted delay applied depends on the facts.
A business that maintains computerized personal information it does not own or license must notify the owner or licensee immediately following discovery of a breach, if the information was, or is reasonably believed to have been, acquired by an unauthorized person (Cal. Civ. Code § 1798.82(b)). A business required to notify more than 500 California residents because of a single breach must also electronically submit a single sample copy of the notice, excluding any personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers (Cal. Civ. Code § 1798.82(f)). The section contains further provisions this page does not describe. These are California's rules; other states set their own.
What a Breach Notice Must Contain
A HIPAA notice, under 45 C.F.R. § 164.404(c), must be in plain language and include, to the extent possible:
- a brief description of what happened, including the date of the breach and the date it was discovered, if known;
- the types of unsecured protected health information involved, such as full name, Social Security number, date of birth, home address, account number, diagnosis or disability code;
- steps individuals can take to protect themselves from potential harm;
- what the covered entity is doing to investigate, mitigate harm and protect against further breaches; and
- contact procedures, including a toll-free number, an email address, a website or a postal address.
The HHS page adds that the toll-free number must stay active for at least 90 days. It also describes substitute notice. If contact information is insufficient or out of date for 10 or more people, the covered entity must post notice on its website's home page for at least 90 days or use major print or broadcast media where those people likely live. For fewer than 10, it may use another written form, the telephone or other means.
California's notice under Cal. Civ. Code § 1798.82(d) must be titled "Notice of Data Breach." It must use the headings "What Happened?", "What Information Was Involved?", "What We Are Doing," "What You Can Do," and "For More Information," in type no smaller than 10-point. Its required content includes the name and contact information of the reporting business.
For a reader trying to make sense of a vague letter, these lists work as a checklist of what it is supposed to explain.
What a Consumer Can Do After Receiving a Breach Notice
A security freeze is one option federal law gives every consumer. Under 15 U.S.C. § 1681c-1(i), a freeze prohibits a consumer reporting agency from disclosing a frozen consumer report to anyone who asks for it. A consumer reporting agency is a company that compiles credit information and sells reports to others, such as the nationwide credit bureaus.
The statute's timing rules:
- Placing it: free of charge, within 1 business day of a request by toll-free telephone or secure electronic means, or 3 business days of a request by mail, once the agency has proper identification.
- Confirmation: within 5 business days, the agency must confirm the freeze and explain how to remove it.
- Removing or lifting it: free, within 1 hour for telephone or electronic requests, or 3 business days by mail, including a temporary lift for a period the consumer chooses.
A freeze does not block every request. The statute's exceptions include existing creditors reviewing or collecting an account, certain government agencies, insurance underwriting, and employment, tenant or background screening.
A fraud alert is a separate option. The FTC's credit freeze and fraud alert page says an initial fraud alert tells businesses to check with the consumer before opening new credit, lasts one year and can be renewed. An extended alert, for people who have completed an FTC identity theft report at IdentityTheft.gov or filed a police report, lasts seven years. According to the CFPB's explanation of security freezes, freezes do not affect credit scores.
Identity Theft and the FCRA: When a Breach Leads to Fraudulent Accounts
A breach does not change a credit report by itself. The Fair Credit Reporting Act becomes relevant when exposed information is used to open accounts, and it is a separate law from breach notification statutes. The FCRA governs consumer reporting agencies and furnishers. A furnisher is a company, such as a lender or card issuer, that sends information about a consumer to a consumer reporting agency.
The identity theft block. Under 15 U.S.C. § 1681c-2(a), an agency generally must block information the consumer identifies as resulting from alleged identity theft within 4 business days after receiving four things: appropriate proof of identity, a copy of an identity theft report, the consumer's identification of the information, and a statement that it does not relate to any transaction by the consumer. The agency must promptly notify the furnisher. It may decline or rescind a block if it reasonably determines the block was made in error, rested on a material misrepresentation, or the consumer obtained goods, services or money from the transaction. More on identity theft and credit reports is on a related page.
The dispute right. When an account opened by someone else shows up on a report, the dispute process is the way to have the credit bureau look at it again. Under 15 U.S.C. § 1681i(a), when a consumer disputes the accuracy or completeness of an item, the agency generally must, free of charge, conduct a reasonable reinvestigation within 30 days. In plain terms, the bureau has to re-check the item rather than simply leave it in place. The 30 days may be extended by up to 15 days if the consumer sends relevant information during that period, but not when the item is found inaccurate or incomplete or cannot be verified. The bureau must also pass the dispute to the company that reported the item within 5 business days. The page on a failed credit bureau investigation describes what follows when that process falls short.
The furnisher's duty. The dispute does not stop with the credit bureau. Under 15 U.S.C. § 1681s-2(b), once the lender or card issuer that reported the item is notified of the dispute, it must investigate, review the relevant information, and report the results. If the item is inaccurate or incomplete, it must tell the other nationwide agencies it reported the item to, so the same error is addressed across reports. If the item is inaccurate, incomplete or cannot be verified, it must promptly modify, delete or permanently block it, all within the bureau's deadline. For someone whose information was misused after a breach, the company behind a fraudulent account has its own obligation to look into it. These rights are explained further under FCRA dispute rights, and what the statute makes potentially available appears under consumer rights remedies.
What This Page Does Not Cover
This page covers the general framework: HIPAA's federal notice rule, California's notice law and the FCRA rights that matter after a breach. It does not cover every federal sector rule, or the details of the FTC's provisions for vendors of personal health records. It also does not cover the security standards companies must keep to prevent a breach; it begins after one happens.
California's breach statute is summarized here only for notice to affected residents, notice to data owners, the Attorney General sample copy, timing and notice format; any other duties under that section are outside this page. State laws outside California are not described, because they differ and a consumer's rights depend on the law that applies. Whether a particular breach, notice or company response violates any law depends on its facts.
If You'd Like a Consumer Rights Case Review
A reader with a question about a breach or identity theft matter may request a consumer rights case review through Federal Consumer Rights.
