Maine healthcare breach data

Notification deadline

As expeditiously as possible and without unreasonable delay; absent the specified law-enforcement delay under § 1348, no more than 30 days after awareness of the breach and identification of its scope. Also subject to any delay reasonably necessary to determine the scope of the breach and identify affected residents. The § 1348 law-enforcement delay is itself limited to no more than 7 business days after the law-enforcement agency determines that notification will not compromise the criminal investigation.

State regulator notice

Required

When individual notice is required, the person must also notify the appropriate state regulator within the Department of Professional and Financial Regulation for persons regulated by that Department; for persons NOT regulated by the Department, notice must instead be given to the Maine Attorney General. There is no numeric threshold on this regulator/AG notice — it is triggered by any breach requiring individual notice.