Maryland healthcare breach data

Notification deadline

Not later than 45 days after the business discovers or is notified of the breach, subject to the specified law-enforcement delay and time reasonably necessary to determine the scope of the breach and restore reasonable integrity to the data system.

State regulator notice

Satisfied by HIPAA compliance

Prior to giving notification to individuals, the business must provide notice to the Office of the Maryland Attorney General. The notice must include the number of affected individuals, a description of the breach, remedial steps taken, and a sample copy of the individual notice.

Substitute compliance depends on actually meeting the federal obligation. A practice outside HIPAA, or one that has not met its federal notice duty, falls back on the requirement below as written. Stated trigger: All breaches (no numeric threshold) — AG notice is required prior to individual notification.