Missouri healthcare breach data

Notification deadline

Without unreasonable delay following discovery of the breach of security, subject to the specified law-enforcement delay and any measures necessary to determine sufficient contact information for affected consumers, determine the scope of the breach, and restore the reasonable integrity of the data system. No numeric outer bound.

State regulator notice

Required above 1,000 residents

If a person is required to notify more than 1,000 Missouri consumers at one time under § 407.1500, the person must notify the Missouri Attorney General of the timing, distribution, and content of the individual notice. This state-agency-notice track under § 407.1500.2(8) is distinct from the parallel consumer-reporting-agency notice obligation (see regulator_notice_citation for the CRA cross-reference).