Alabama healthcare breach data

Notification deadline

As expeditiously as possible and without unreasonable delay, taking into account the time necessary to allow the covered entity to conduct an investigation in accordance with § 8-38-4; the covered entity shall provide notice within 45 days of the covered entity's receipt of notice from a third-party agent that a breach has occurred or upon the covered entity's determination that a breach has occurred and is reasonably likely to cause substantial harm to the individuals to whom the information relates. Subject to the § 8-38-5(c) law-enforcement delay.

State regulator notice

Required above 1,000 residents

If the number of Alabama individuals a covered entity is required to notify under § 8-38-5 exceeds 1,000, the covered entity must provide written notice of the breach to the Alabama Attorney General as expeditiously as possible and without unreasonable delay, within 45 days of the covered entity's receipt of notice from a third-party agent or determination that a breach has occurred. The notice must include the events synopsis, approximate number of affected Alabama individuals, any services offered, and contact information for the responsible employee/agent.