New Hampshire healthcare breach data

Notification deadline

As soon as possible after the person or business promptly determines the likelihood that the information has been or will be misused, when misuse of the personal information has occurred or is reasonably likely to occur.

State regulator notice

Required

State-side notice routes as follows under § 359-C:20: (i) entities subject to RSA 358-A:3 (New Hampshire Consumer Protection Act primary-regulator scheme, generally covering banks and other regulated financial or insurance entities under their designated state or federal regulator) notify their primary regulator; (ii) all other entities notify the New Hampshire Attorney General. The state notice must include the anticipated date of the individual notice and the approximate number of NH individuals to be notified. No numeric threshold applies to the state-side notice; it is triggered by any breach requiring individual notice.