State data breach laws vs HIPAA for practices

When a practice has a breach, the HIPAA Breach Notification Rule is the first rule people think of. It is not the only one. Each state has its own breach notification law, and those laws can ask for a shorter deadline, a notice to the state attorney general, or notice for data that HIPAA does not treat as protected health information at all. A state law can treat a HIPAA notice as enough, or it can say nothing about HIPAA. This guide explains how the two layers fit together, walks through three state laws we read in full, and gives a practice a plan it can set up before anything goes wrong.

This guide is about the state layer. What goes into the patient letter under HIPAA, and the HHS and media notices, is in our guide to writing a HIPAA breach notification letter. Health apps and other businesses outside HIPAA fall under the FTC rule covered in our guide to the FTC Health Breach Notification Rule. State consumer health data laws in Nevada and Connecticut are in our guide to consumer health data privacy laws.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: 45 CFR 160.103, 160.202, 160.203, 164.404 and 164.408; 16 CFR 318.1; the National Conference of State Legislatures summary of security breach notification laws (updated January 17, 2022); Revised Code of Washington sections 19.255.005, 19.255.010 and 19.255.030; Florida Statutes section 501.171 (2026); Texas Business and Commerce Code sections 521.002, 521.053 and 521.151, and the enrolled text of Texas SB 768 (2023). This is not a fifty-state survey. State laws change, and which laws apply depends on where each affected person lives as well as where the practice is. If you think a breach may have happened, call a health care attorney first.

Two layers: the HIPAA rule and the state laws

For a covered entity such as a physician practice, dental office or clinic that sends insurance claims electronically, the HIPAA rule sits at 45 CFR 164.400 to 164.414. Under 164.404(b), notice to each affected individual goes out without unreasonable delay and in no case later than 60 calendar days after discovery of a breach of unsecured protected health information. Under 164.408, breaches affecting 500 or more individuals go to HHS at the same time as the patient notices, and smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. Our breach letter guide covers those steps in detail.

The state layer is separate. The National Conference of State Legislatures summary, updated January 17, 2022, says all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses to notify individuals of security breaches of personally identifiable information, and lists the statute for each one. Each state writes its own definitions of personal information and of a breach, its own deadlines and its own rules on who else must be told.

Why HIPAA does not simply replace the state laws

HIPAA has its own preemption rule. Under 45 CFR 160.203, a HIPAA standard preempts a provision of state law that is contrary to it, subject to listed exceptions. Section 160.202 defines contrary: a covered entity would find it impossible to comply with both the state and federal requirements, or the state provision stands as an obstacle to the purposes of the federal law.

A state breach law that sets a 30 day deadline is not impossible to follow alongside a 60 day outer limit: a practice that sends notice within 30 days meets both. A state law that asks for a letter to the attorney general adds a step without blocking any HIPAA step. Whether a particular state provision is preempted is a legal question for counsel, but a practice should plan on the assumption that both layers apply unless the state law itself says otherwise. The next sections show three states that answer that question in three different ways.

Washington: 30 days, with a HIPAA carve-out

Under RCW 19.255.010(8), notice to affected consumers must be made as expediently as possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered, unless law enforcement asks for a delay or the delay is needed to determine the scope of the breach and restore the integrity of the system. Under 19.255.010(7), a business that must notify more than five hundred Washington residents from a single breach must also notify the attorney general no more than thirty days after the breach was discovered, with the number of residents affected, the types of information, the time frame of exposure, the steps taken to contain the breach and a sample copy of the notice.

Washington’s definition of personal information, in RCW 19.255.005, includes a name combined with information about a consumer’s medical history, mental or physical condition, or a health care professional’s diagnosis or treatment, and a name combined with a health insurance policy or identification number.

RCW 19.255.030(1) is the carve-out. A covered entity under HIPAA is deemed to have complied with the chapter with respect to protected health information if it has complied with section 13402 of the HITECH Act, the federal breach notification provision. The same subsection still requires covered entities to notify the Washington attorney general under 19.255.010(7), on the timing of section 13402 instead of the state’s thirty day timeline.

Use: one breach plan that sends HIPAA notices on the federal timeline and adds the Washington attorney general notice when more than five hundred Washington residents are affected.
Avoid: reading the carve-out as a full exemption. It covers protected health information and still leaves the attorney general notice in place.

Florida: 30 days, with a federal regulator option

Florida Statutes section 501.171 applies to a covered entity defined as a commercial entity that acquires, maintains, stores or uses personal information. Its definition of personal information includes a name combined with any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional, and a name combined with a health insurance policy number or subscriber identification number.

Under 501.171(4)(a), notice to each affected individual goes out as expeditiously as practicable and without unreasonable delay, but no later than 30 days after the determination of a breach or reason to believe a breach occurred, unless law enforcement asks in writing for a delay. Under 501.171(4)(c), notice is not required if, after an appropriate investigation and consultation with law enforcement, the entity reasonably determines that the breach has not and will not likely result in identity theft or other financial harm; that determination must be in writing, kept for 5 years and sent to the department within 30 days. Under 501.171(3), a breach affecting 500 or more individuals in Florida must be reported to the Department of Legal Affairs within the same 30 days, with 15 more days available if good cause is given in writing within the first 30.

Section 501.171(4)(g) says notice given under the rules of the entity’s primary or functional federal regulator is deemed to comply with the individual notice requirement, and that an entity that timely provides a copy of that notice to the department is deemed to comply with the department notice requirement. Whether HHS counts as a practice’s primary or functional federal regulator for this purpose is a question for counsel. Either way, the department copy has to be timely.

Use: a plan that treats 30 days as the working deadline for Florida patients and sends the department a copy of the notice.
Avoid: assuming a HIPAA letter sent on day 55 also satisfies Florida without a lawyer’s reading of 501.171(4)(g).

Texas: no HIPAA carve-out and a 30 day attorney general notice

Texas Business and Commerce Code section 521.002 defines sensitive personal information to include information that identifies an individual and relates to the physical or mental health or condition of the individual, the provision of health care to the individual, or payment for health care. Section 521.053 does not contain a HIPAA exception.

Under 521.053(b), notice to each individual goes out without unreasonable delay and not later than the 60th day after the date the business determines the breach occurred. Under 521.053(i), as amended by SB 768 effective September 1, 2023, a breach involving at least 250 Texas residents must be reported to the attorney general as soon as practicable and not later than the 30th day after that date, through the electronic form on the attorney general’s website. The form asks for, among other things, the number of Texans affected and the number already sent notice. The attorney general posts a public listing of the notices received.

Section 521.053(b-1) adds a detail for practices that see patients from other states: if an affected person lives in a state with its own breach notice law, the Texas notice to that person may be given under that state’s law or under the Texas section.

Use: a calendar that starts the Texas attorney general clock on the day the breach is determined, so the state report is ready by day 30 even when patient letters take longer to prepare.
Avoid: waiting for the full HIPAA risk assessment to finish before anyone looks at the Texas count of 250 residents.

Data HIPAA does not cover but state laws do

Under 45 CFR 160.103, protected health information excludes individually identifiable health information in employment records held by a covered entity in its role as employer. A practice’s own staff files, payroll records and benefits paperwork are therefore outside the HIPAA breach rule. They are not outside state law: the Washington, Florida and Texas definitions above include Social Security numbers, driver’s license numbers and financial account numbers combined with a name, and none of them limits coverage to patients.

The same gap can show up with a practice’s other records: a list of people who signed up for a newsletter, a spreadsheet of job applicants, or card details taken for a cash-pay service. Which law reaches which record is for counsel to sort out, but a breach plan that only asks whether patient information was involved will miss these.

What the FTC rule covers

The FTC Health Breach Notification Rule at 16 CFR part 318 applies to vendors of personal health records, related entities and their service providers. Section 318.1 says it does not apply to HIPAA-covered entities, or to any other entity to the extent it acts as a business associate of a HIPAA-covered entity. A practice’s own breach falls under HIPAA and state law. A health app or wellness business that is not covered by HIPAA should read our FTC rule guide.

Building one plan that meets the shortest deadline

The simplest approach is to plan for the strictest timeline that could apply and let the longer ones take care of themselves. A practice with patients in more than one state needs to know the states before a breach, not after.

List the states your patients and staff live in. Patient addresses in the practice management system and staff addresses in payroll give a starting list.
For each state, note the individual notice deadline, the attorney general or agency notice threshold and deadline, any HIPAA carve-out, and the credit bureau notice threshold. Have counsel check the list once a year.
Set the working deadline to the shortest one on the list. For the three states in this guide, that is 30 days for at least one notice.
Write down the trigger each law uses. Washington counts from discovery, Florida from the determination of a breach or reason to believe one occurred, and Texas from the date the business determines the breach occurred.
Keep the addresses and online forms for each attorney general office in the plan, so no one is searching for them during the first week.
Prepare a letter template that can carry both the HIPAA content and any state-required content, and have counsel approve it in advance.
Agree with your business associates, in writing, how fast they will tell you about an incident. Florida’s statute, for example, gives a third-party agent 10 days to notify the covered entity.

The website and marketing side of a breach

A breach is a legal and patient care event first, but the website and marketing calendar are part of the response. Under 45 CFR 164.404(d)(2), if contact information is missing or out of date for 10 or more individuals, the substitute notice must be either a conspicuous posting for 90 days on the home page of the covered entity’s website or conspicuous notice in major print or broadcast media where the affected people likely live, with a toll-free number active for at least 90 days. Florida and Texas allow website posting as part of substitute notice in their own statutes as well.

Know who can add a notice to the home page within a day, and test that it shows on mobile.
Pause scheduled promotional emails, texts and social posts while notices are going out, so a patient does not get an upbeat offer the same week as a breach letter.
Route any press or review responses through the person counsel has named. Our guide to replying to reviews under HIPAA covers what not to confirm in a public reply.
Keep the privacy policy on your site accurate about what you collect and who you share it with. Our guide to practice website privacy policies covers what to include.

Where practices get caught out

Treating 60 days as the deadline everywhere, when a state on the patient list sets 30.
Checking only the state the practice is in, when the law follows where each affected person lives.
Forgetting the attorney general notice in a state with a HIPAA carve-out for patient letters.
Leaving staff and job applicant records out of the breach plan because they are not patient records.
Starting the clock late because the team waited for a vendor’s full report before recording when the breach was determined.
Having no one who can post a home page notice quickly.

Claims to leave out

Section 5 of the FTC Act, 15 U.S.C. 45, prohibits deceptive acts or practices. A claim about data security on a practice website is a claim like any other, and it has to be true.

Avoid: “Your data is 100 percent secure” or “We can never be breached.” No one can support that.
Avoid: badges or phrases such as “HIPAA certified” that suggest an official approval you cannot point to.
Avoid: breach letters that tell patients nothing sensitive was involved before the review is finished.
Use: plain statements of what you do, such as “We limit who can see your records and review access regularly,” if that is true for your practice.

Illustration: one incident, three clocks

This is an invented example to show the timing, not a real case. A practice in Washington learns from its billing vendor that an unauthorized person accessed a file with patient names, insurance ID numbers and visit dates. Counsel works through the HIPAA risk assessment and concludes it is a breach. The patient list includes people in Washington, Florida (seasonal residents) and Texas (patients who moved). The practice’s plan already lists each state’s rules. The team sets the working deadline at 30 days for each patient letter, sends the Florida department a copy of the notice and the Texas attorney general report on the same day, and sends the Washington attorney general notice on the HIPAA timeline because the practice is a covered entity and more than five hundred Washington residents are affected. It posts a home page notice for patients it cannot reach and pauses its monthly newsletter.

Checklist

We have a list of the states our patients and staff live in, updated at least once a year.
For each state, counsel has noted the deadlines, the agency notice rules and any HIPAA carve-out.
Our working deadline is the shortest one on the list.
Each business associate has agreed in writing how quickly they report incidents to us.
We know who decides that a breach has been determined, and that date is written down the same day.
Our letter template has been approved by counsel for both HIPAA and state content.
Someone can post a home page notice within a day.
We know how to pause scheduled marketing messages.
Staff, applicant and payment records are in the breach plan, not only patient records.
Our website makes no security claim we cannot support.

How we help

We build websites, local search, patient lead generation and AI front desk tools for independent practices and health businesses. For breach readiness, that means sites where a home page notice can be posted quickly, forms that collect only what a practice needs, marketing calendars that can be paused, and site copy that makes no security promise the practice cannot keep. We do not give legal advice; we work with your counsel. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Does HIPAA preempt state data breach laws?

Only where a state provision is contrary to HIPAA under 45 CFR 160.202, meaning it is impossible to comply with both or the state law blocks the federal purpose. A shorter state deadline or an extra notice to the attorney general can be met alongside HIPAA, so practices should plan to follow both.

Do all states have a breach notification law?

The NCSL summary, updated January 17, 2022, says all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have one, and lists each statute.

Which state breach deadlines are shorter than HIPAA’s 60 days?

Of the three states in this guide, Washington sets thirty calendar days after discovery for consumer notice, Florida sets 30 days for individual and department notice, and Texas sets 30 days for the attorney general report when at least 250 Texans are affected. Check each state on your patient list with counsel.

Is a HIPAA covered entity exempt from Washington’s breach law?

RCW 19.255.030 treats a covered entity as having complied for protected health information if it followed the HITECH breach provision, but it must still notify the Washington attorney general when more than five hundred residents are affected.

Do state breach laws cover employee records?

HIPAA excludes employment records held by a covered entity as employer from protected health information under 45 CFR 160.103. State laws define personal information by data type, such as Social Security or account numbers with a name, so staff records can fall under them.

Does the FTC Health Breach Notification Rule apply to my practice?

16 CFR 318.1 says the rule does not apply to HIPAA-covered entities or to entities acting as their business associates. It covers personal health record vendors and related businesses outside HIPAA.

State data breach laws vs HIPAA for practices: how state notice rules sit on top of the HIPAA breach rule, with Washington, Florida and Texas as examples