Virginia healthcare breach data

Notification deadline

Without unreasonable delay following discovery or notification of the breach of the security of the system, subject to reasonable delays for scope determination, restoration of system integrity, and law-enforcement requests.

State regulator notice

Required

The Office of the Attorney General must be notified without unreasonable delay when notice is provided to Virginia residents. Additionally, when notifying more than 1,000 persons at one time, the entity must also notify (without unreasonable delay) the Attorney General and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis.