North Dakota healthcare breach data

Notification deadline

In the most expedient time possible and without unreasonable delay, consistent with (i) the legitimate needs of law enforcement as provided in § 51-30-04, and (ii) any measures necessary to determine the scope of the breach and to restore the integrity of the data system. No numeric outer bound.

State regulator notice

Not required of covered entities

Any person that experiences a breach of the security system shall disclose to the North Dakota Attorney General by mail or electronic mail any breach of the security system which exceeds 250 individuals. This is a direct state-AG-notice obligation triggered by breach size, not by individual-notice.

That exclusion turns on covered-entity status. A practice that conducts no HIPAA standard transaction — and, where the exclusion names covered entities only, a business associate — is not outside the section, and the requirement below applies to it as written. Stated trigger: Breaches exceeding 250 North Dakota individuals.