“In the most expedient time possible…”

According to DataBreaches[.]Net, while many state laws require breach notification “in the most expedient time possible, without unreasonable delay,” enforcement has been sporadic and the rules often allow delays to secure systems or determine scope. The article notes that HIPAA requires regulated entities to notify affected individuals within 60 calendar days of discovering a breach, with a business associate needing to notify the covered entity promptly, potentially creating a longer gap overall.

It cites HHS OCR enforcement as relatively sparse, highlighting a $475,000 settlement with Presence Health in Illinois and a subsequent $600,000 settlement with PIH Health after a phishing incident, while other cases mention notification failures only within broader investigations. DataBreaches also points to five recent ransomware dark web listings involving U.S. medical entities, none of which appear to have reported incidents to HHS OCR or posted notices on their websites.

The author argues for public announcements within 48 hours of discovery when threat actors leak data and urges legislative amendments to require prompt notice when data is leaked. Overall, the piece critiques the frequency of untimely notifications and characterises the current regime as insufficiently enforced, calling for faster disclosure when data has been leaked.