Idaho healthcare breach data

Notification deadline

As soon as possible and without unreasonable delay following discovery of a breach of the security of the system, subject to (i) any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system, and (ii) the specified law-enforcement delay under § 28-51-105(3).

State regulator notice

Not required

For COMMERCIAL entities and individuals: § 28-51-105 does NOT impose an Idaho Attorney General notice obligation. The 24-hour Idaho AG notice at § 28-51-105 is scoped to AGENCIES ONLY — 'When an agency becomes aware of a breach of the security of the system, it shall, within twenty-four (24) hours of such discovery, notify the office of the Idaho attorney general.' A HIPAA-regulated private dental, medical, behavioral-health, chiropractic, physical-therapy, or optometry practice operating in Idaho is not an 'agency' (which under § 28-51-104 refers to state agencies and their political subdivisions), and therefore does not owe the 24-hour AG notice.