Walk It Through: The Breach Letter

Notice within 30 days, 15 more for good cause, and daily penalties for a late one.

A letter arrives saying a covered entity's systems were breached.

Two things a person in this spot might do. Picking one shows what the law says about it.

One breach letter from one covered entity. What counts as personal information, the forms notice may take, and who enforces the penalty are not worked through here.

A practice walkthrough, not a prediction of how any real one will go. Legal information, not legal advice.

Words this turns on

Terms with a legal meaning that is narrower than the everyday one. Each links to the definition and the authority behind it.

Covered entityThe one that gives notice to each individual whose personal information was or is reasonably believed to have been accessed, no later than 30 days after determining a breach occurred. For a breach affecting 500 or more individuals in this state, the Department of Legal Affairs is told too.