Our previous article explains what Arizona notification law requires. This one is what to do when something has actually happened, hour by hour and then day by day.
The complication in Arizona is that you are running two clocks at once, and they start at different moments and run for different lengths.
Hours 0 to 24: contain and preserve
Disconnect affected systems from the network. Do not wipe or rebuild anything, because you will need the evidence to determine scope. Write down what you observed and when, in a single running log with times. That log becomes the record of when determination happened, and determination starts the state clock.
Call your cyber insurer before you call anyone else. Most policies require it and many will direct you to counsel and a forensics firm they have already vetted.
Days 1 to 7: work out scope
What data, whose data, how many people, and were they Arizona residents. The count matters because 1,000 or more Arizona residents triggers Attorney General and consumer reporting agency notification.
Whether the information was encrypted matters too, and it is worth knowing the answer in advance rather than finding out under pressure.
Days 7 to 45: notify
Individuals, in the most expedient manner and no later than 45 days from determination. That is the Arizona limit and it is 15 days tighter than the federal one.
If 1,000 or more Arizona residents are affected, the Attorney General and the credit reporting agencies inside the same window.
Federal reporting to Health and Human Services follows the HIPAA rules, which differ depending on whether the breach affects 500 or more individuals.
The dual track, plainly
Work to 45 days for everything. Do not attempt to run the federal 60 day timeline in Arizona and rely on the state exemption to cover you, because the exemption depends on complete federal compliance and the margin for error is thin.
What to have ready now
A named person who decides that determination has occurred. A written contact list including your insurer, counsel and forensics. A template notification letter, unfinished but structured. And a tested way to produce a patient mailing list.
None of this is expensive. All of it is much harder to assemble during the event than before it.