Hawaii healthcare breach data

Notification deadline

Following discovery or notification of the breach of security of the system, without unreasonable delay, consistent with (i) the legitimate needs of law enforcement as provided in HRS § 487N-2(c), and (ii) any measures necessary to determine sufficient contact information for the affected persons, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data system.

State regulator notice

Satisfied by HIPAA compliance

In the event a business provides notice to more than 1,000 persons at one time pursuant to HRS § 487N-2, the business must notify in writing, without unreasonable delay, (i) the State of Hawaii's Office of Consumer Protection AND (ii) all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a(p), of the timing, distribution, and content of the notice. There is no direct Hawaii Attorney General notice trigger separate from the Office of Consumer Protection notice.

Substitute compliance depends on actually meeting the federal obligation. A practice outside HIPAA, or one that has not met its federal notice duty, falls back on the requirement below as written. Stated trigger: More than 1,000 Hawaii persons notified at one time.