Delaware healthcare breach data

Delaware Personal Data Privacy Act (Title 6, Chapter 12D) is a distinct regime

The Delaware Personal Data Privacy Act at Del. Code tit. 6, ch. 12D (effective January 1, 2025) is a separate controller-level privacy regime and does NOT itself modify the § 12B-102 breach-notification obligation. Importantly, the DPDPA does NOT contain a blanket entity-level exemption for HIPAA covered entities. Instead, § 12D-103(c) uses TARGETED DATA-LEVEL exemptions — the DPDPA excludes categories of information from its scope, including protected health information governed by HIPAA, patient safety work product and related material, information governed by Part 2 of 42 CFR (substance-use-disorder patient records), certain public-health-activity data, and other health-related information categories. An entity that is a HIPAA covered entity is therefore NOT automatically outside the DPDPA — data it holds that falls outside HIPAA (e.g., employee-benefits data, marketing lists, non-patient records) remains subject to the DPDPA. Practical effect: § 12B-102 continues to apply per § 12B-103(b) procedural substitution for HIPAA breach handling, and the DPDPA's data-level exemptions govern which of the entity's holdings are outside its scope.