Editor’s note (October 2026): We updated the penalties section of this post to correct how it described the California Consumer Privacy Act. The $100 to $750 per-consumer range is the statutory damages range for consumer lawsuits over certain data breaches, not a government penalty. Government civil penalties are separate, and since the CPRA took effect in 2023 the California Privacy Protection Agency also enforces the law. These dollar amounts are now adjusted for inflation. Contact Revision Legal for current advice.
When there is a data security breach, there are state and federal data breach notification laws that places time limits on when those who are affected must be notified. A failure to make a timely notification of the data breach can be quite costly. Several state data breach notification laws and some federal data breach notification laws, such as the Health Insurance Portability and Accountability Act (HIPAA), impose civil fines for untimely notification.
It is important for data breaches to be reported to those who may have been affected in a timely manner, so that those with exposed personal data can take steps to protect themselves from further harm. The sooner a person with compromised data learns about a privacy breach, the sooner steps can be taken to mitigate any possible repercussions of the data exposure, such as checking credit reports and obtaining credit or identify theft monitoring services.
An Illinois Health System Slammed With Settlement for Slow Notification
According to a recent article on Bloomberg BNA, an Illinois Health System was recently saddled with a hefty settlement after taking too long to report a data breach to the proper entities under the breach notification laws of HIPAA. Presence Health learned that it had been subject to a data breach involving paper records in October of 2013, but waited until early February 2014 before reporting the data breach to those who were affected. This nearly four-month delay well exceeded the 60-day window to make notifications under the breach notification laws of HIPAA.
Data breaches are not to be taken lightly in Illinois, particularly when the data breach involves confidential patient information. Presence Health claims that the notification delay was due to a miscommunication and made no admission of liability when it agreed to pay $475,000 in its recent HIPPA settlement. In addition to the money, Presence Health also agreed to provide a two-year corrective action plan.
The HIPAA Breach Notification Rule, codified as 45 CFR §§ 164.400–414, requires HIPAA covered entities and their business associates to issue notifications to those affected by a data breach within 60 days of the discovery of the data breach. The notification must further include:
- An explanation of the breach, identification of the type of data that was compromised in the breach,
- Information on how those affected by the breach can take steps to protect themselves,
- An explanation of what the HIPAA covered entities or the business associates is doing to address and correct the data breach, and
- Contact information so that those who are affected by the breach can learn more information.
Consult With a Data Breach Lawyer
There is no time to lose once a data security breach has been identified. A majority of states have data breach notification laws that set forth specific timeframes in which notifications need to be made. There are costly consequences for those entities who do not take notification of data breach situations seriously.
A State-by-State Overview of Breach Notification Deadlines
All 50 states have enacted data breach notification laws, but the deadlines and requirements vary significantly. Understanding which states’ laws apply — and which imposes the shortest deadline — is the first task for any business responding to a breach that affected residents in multiple states.
- Florida (Fla. Stat. § 501.171): 30 days from determination that a breach occurred. Among the shortest deadlines in the country.
- Colorado (Colo. Rev. Stat. § 6-1-716): 30 days after determining a breach occurred. Also requires notification to the Colorado AG when more than 500 Colorado residents are affected.
- New York (N.Y. Gen. Bus. Law § 899-aa): In the most expedient time possible and without unreasonable delay, and since December 2024 no later than 30 days after discovery. The SHIELD Act extended the definition of private information and broadened security program requirements.
- California (Cal. Civ. Code § 1798.82): Since January 1, 2026, within 30 calendar days of discovering or being notified of the breach, subject to delays for law enforcement needs or to determine the scope of the breach. If more than 500 California residents are notified, a sample copy of the notice must be submitted to the Attorney General within 15 calendar days of notifying consumers. (Section 1798.29 imposes parallel rules on state agencies.)
- Texas (Tex. Bus. & Com. Code § 521.053): As quickly as possible, no later than 60 days after discovery.
- HIPAA (45 CFR § 164.410): 60 days from discovery for covered entities and business associates. If a breach affects 500 or more residents of a state, concurrent media notification is required in addition to individual notification.
When a breach affects residents of multiple states, the business must simultaneously comply with each affected state’s law. In practice, this means identifying the state with the shortest notification deadline and using that as the controlling deadline for all notifications — because no state’s deadline can be missed, and the only way to comply with all of them is to comply with the fastest.
What Constitutes “Discovery” Under Notification Statutes?
The notification clock starts at “discovery” — but discovery is often not a single moment. Courts and regulators have generally held that discovery occurs when the business has sufficient information to reasonably determine that a breach has occurred, even if the full scope of the breach is not yet known. A business cannot toll the notification deadline by conducting an extended forensic investigation before formally declaring that a breach has been discovered.
This means that businesses must often begin the notification process while the forensic investigation is still underway, supplementing initial notifications with follow-on communications as additional facts become known. Some state statutes expressly permit phased notification — an initial notice within the deadline followed by a supplemental notice once more information is available. Others require a single notice containing all required elements, making it essential to move the forensic investigation quickly.
The Penalties: What’s Actually at Stake
Civil fines for untimely or non-compliant breach notification are real and have been growing. HIPAA fines are tiered based on culpability, ranging from $100 per violation (for violations where the entity was unaware) to $50,000 per violation (for willful neglect not corrected within 30 days), with annual caps of $1.5 million per violation category. The Presence Health settlement of $475,000 for a 120-day notification delay is one of dozens of HIPAA enforcement actions HHS OCR has resolved through settlement or civil money penalty.
State attorneys general are also active enforcement authorities. In California, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), works on two tracks. Consumers whose personal information is exposed in certain data breaches caused by a business’s failure to maintain reasonable security may sue for statutory damages of $100 to $750 per consumer per incident, or actual damages if greater (Cal. Civ. Code § 1798.150). Separately, the California Privacy Protection Agency and the Attorney General may seek civil penalties of up to $2,500 per violation, or $7,500 per intentional violation. These amounts are adjusted for inflation. In Florida, a covered entity that fails to give required notice faces civil penalties of $1,000 for each day for the first 30 days, then $50,000 for each additional 30-day period (or part of one) for up to 180 days, and up to $500,000 if the violation continues beyond 180 days. These penalties apply per breach, not per affected individual, and a violation is also treated as an unfair or deceptive trade practice (Fla. Stat. § 501.171(9)). In addition to regulatory penalties, untimely notification significantly increases the plaintiff class’s damages claim in breach class action litigation, as courts have found that delayed notice extends the period of consumer harm.
The attorneys at Revision Legal have extensive experience helping businesses of all sizes manage data breach notification obligations across all 50 states and under federal law. If your business has experienced a breach, or if you want to build a notification compliance program before one occurs, contact us using the form on this page or call us at 855-473-8474.
Coordinating Multi-State Notification: A Practical Framework
When a breach affects residents across multiple states, the operational challenge of simultaneous multi-state notification is substantial. A business must identify the residential location of every affected individual, map each state’s specific notification requirements and deadlines, draft notification letters that satisfy the most demanding requirements of every applicable state simultaneously, engage notification vendors capable of meeting print and mail deadlines, and prepare regulatory notifications to state attorneys general in the required format and timeframe.
Businesses that attempt to manage multi-state breach notification without specialized legal counsel frequently make costly errors — sending notifications that omit required content elements, missing notification deadlines for individual states, or failing to notify state regulators in states that require concurrent government notification alongside individual notice. Each such error can independently give rise to regulatory enforcement action and can support class action plaintiffs’ claims that the notification program was inadequate.
The experienced data breach notification attorneys at Revision Legal have guided businesses through multi-state notifications involving residents of all 50 states simultaneously, and have developed streamlined protocols for meeting even the most compressed notification deadlines. If your business has experienced a breach, do not attempt to navigate multi-state notification without counsel. Contact us using the form on this page or call us at 855-473-8474.
