Arizona healthcare breach data

Notification deadline

Within forty-five days after the determination that a security system breach has occurred, subject to the specified law-enforcement delay and any measures reasonably necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

State regulator notice

Not required of covered entities

If the breach requires notification of more than one thousand Arizona individuals, the person must notify in writing (a) the three largest nationwide consumer reporting agencies and (b) the Arizona Attorney General and the Director of the Arizona Department of Homeland Security.

That exclusion turns on covered-entity status. A practice that conducts no HIPAA standard transaction — and, where the exclusion names covered entities only, a business associate — is not outside the section, and the requirement below applies to it as written. Stated trigger: More than 1,000 Arizona individuals to whom notice is required.