Iowa healthcare breach data

Notification deadline

Following discovery of the breach of security (or receipt of notification under § 715C.2(2) for third-party maintainers), in the most expeditious manner possible and without unreasonable delay, consistent with (i) the legitimate needs of law enforcement as provided in § 715C.2(3), and (ii) any measures necessary to sufficiently determine contact information for affected consumers, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data. No numeric outer bound.

State regulator notice

Not required of covered entities

If a breach of security requires notification to more than 500 Iowa residents under § 715C.2, the person must give written notice of the breach of security to the director of the Consumer Protection Division of the Office of the Iowa Attorney General within 5 business days after giving notice of the breach of security to any consumer under § 715C.2. The AG notice runs on its own 5-business-day clock keyed to the consumer notice, distinct from the individual-notice 'most expeditious manner possible / without unreasonable delay' standard.

That exclusion turns on covered-entity status. A practice that conducts no HIPAA standard transaction — and, where the exclusion names covered entities only, a business associate — is not outside the section, and the requirement below applies to it as written. Stated trigger: More than 500 Iowa residents to whom notification is required.