Proposed Law Would Criminalize Failures To Report Data Breaches

A draft bill recently introduced in the U.S. Senate serves as a good reminder that compliance with data breach reporting requirements is critical. This bill follows significant, high-profile data breaches by Uber and Equifax, both of which involved millions of individuals (87 million and 145 million, respectively) and both of which went unreported for a significant period of time following discovery by the companies. Equifax took more than a month to notify the public, while Uber took more than a year.

The proposed "Data Security and Breach Notification Act" (the Act) would require an organization subject to Federal Trade Commission (FTC) jurisdiction—which includes health care organizations—to notify each individual whose personal information is implicated in a data breach and to also notify credit reporting agencies if more than 5,000 people are affected. Notice would be required within 30 days of the breach unless there is justification for delay, such as a law