Vermont healthcare breach data

Notification deadline

In the most expedient time possible and without unreasonable delay, but no later than 45 days after the discovery or notification of the security breach, consistent with (i) the legitimate needs of the law enforcement agency under § 2435(b)(3)-(4), and (ii) any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system.

State regulator notice

Required

State-side notice routes as follows under § 2435(b)(3): (A) a data collector regulated by the Vermont Department of Financial Regulation under Title 8 or Title 9 must provide notice of a breach to the Department; ALL OTHER data collectors must provide notice to the Vermont Attorney General. Preliminary notice with breach date, discovery date, and preliminary description is required within 14 business days under § 2435(b)(3)(B)(i), with a fuller notice provided when consumer notice is distributed. No numeric threshold applies.