Rhode Island healthcare breach data

Notification deadline

In the most expedient time possible, but no later than 45 calendar days after confirmation of the breach and the ability to ascertain the information required for notice, subject to the § 11-49.3-4 law-enforcement provision. State and municipal agencies have an accelerated 30-day timeline under § 11-49.3-4(a)(2); private entities have the ordinary 45-calendar-day outer bound.

State regulator notice

Satisfied by HIPAA compliance

When individual notice is required, the entity must also provide notice to the Rhode Island Attorney General and, when applicable, to major consumer reporting agencies. The state notification and consumer-reporting-agency notification must not delay the affected-resident notice. The Attorney General notice threshold is more than 500 Rhode Island residents to be notified.

Substitute compliance depends on actually meeting the federal obligation. A practice outside HIPAA, or one that has not met its federal notice duty, falls back on the requirement below as written. Stated trigger: More than 500 Rhode Island residents to be notified triggers Attorney General notice.