Illinois healthcare breach data

Notification deadline

Following discovery or notification of the breach, in the most expedient time possible and without unreasonable delay, subject to the specified law-enforcement delay and any measures reasonably necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound.

State regulator notice

Required above 500 residents

For data collectors that are NOT HIPAA/HITECH covered entities or business associates operating under §50, § 10(e) requires notification to the Illinois Attorney General when a single breach requires notification of more than 500 Illinois residents, no later than when notice is provided to consumers. §10(e) expressly excludes covered entities and business associates in compliance with §50 from this ordinary >500-resident rule — for those entities the HIPAA-specific rule below governs instead.