Breach notification

Definition

The legal duty to tell people when their data has gotten out.

Why It Matters

Every state imposes one, and a practice holding health records carries a federal duty on top: 45 CFR 164.404 allows no more than sixty calendar days from discovery, and discovery is dated from when anyone on the staff should reasonably have known, not from when the owner was told. The buyer's exposure is the incident that already happened and was never reported, since the duty travels with the entity in a stock deal and the facts travel either way. Ask what incidents have been logged, who assessed each one, and whether any of it is written down outside one person's memory.

In numbers: A practice that discovers a breach on the first of the month has 60 days to notify the people in it, and at 500 or more it also tells the media and the Secretary.