Oklahoma healthcare breach data

Notification deadline

Without unreasonable delay following determination or notification of the breach of the security of the system, subject to (i) the specified law-enforcement delay under § 163(D), and (ii) any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system. No numeric outer bound for the individual notice itself.

State regulator notice

Required at 500+ residents

Entities must notify the Oklahoma Attorney General within 60 days of notifying Oklahoma residents. The notice must include the breach date, determination date, nature of the breach, exposed information type, number of affected Oklahoma residents, estimated monetary impact, and safeguards employed. Breaches affecting fewer than 500 Oklahoma residents are exempt from the AG-notice requirement.