As we approach 2019, companies will want to keep in mind the
changes that are coming to various US states' breach notice
laws. On January 1, 2019 Iowa's law, which has already been
amended twice since it was passed in 2008, will change again.
Under this update companies subject to and
compliant with HIPAA will have certain exceptions under the law.
Previously only financial entities could take advantage of such
exceptions. This change brings Iowa in line with many other states
with similar exemptions. Encrypted will now be defined to
mean a method that meet industry standards. Finally, the
attorney general will need to be notified five days after notice is
made to impacted individuals. This is instead of five days after
discovering the breach.
