Utah healthcare breach data

Notification deadline

In the most expedient time possible without unreasonable delay, considering the legitimate investigative needs of law enforcement, after determining the scope of the breach of system security, and after restoring the reasonable integrity of the system. No numeric outer bound.

State regulator notice

Required at 500+ residents

If misuse involves 500 or more Utah residents, the person must provide notification to (i) the Office of the Utah Attorney General AND (ii) the Utah Cyber Center created in Section 63A-16-1102. The notification must include prescribed information under § 13-44-202(6)(b) (date of breach, date of discovery, number of affected persons and Utah residents, type of personal information involved, and a short description).