Arizona’s 45 Day Breach Notification Rule: What Medical Practices Need to Know

Most practices know HIPAA gives them 60 days to notify after a breach. Fewer know that Arizona gives them 45.

The statute is ARS 18-552. It requires notification to affected individuals in the most expedient manner possible and no later than 45 days after determining that a breach has occurred.

That 45 day clock starts on determination, not on discovery of something suspicious and not on the conclusion of your investigation. Working out when determination happened is often the hardest question in a real incident.

If 1,000 or more Arizona residents are affected, you must also notify the Arizona Attorney General and the nationwide consumer reporting agencies, within the same window.

Penalties. A knowing and wilful violation is an unlawful practice under Arizona consumer law. Civil penalties run up to $10,000 per violation with an aggregate cap of $500,000. Only the Attorney General may enforce it.

How it interacts with HIPAA

This is where it gets fiddly and where practices get it wrong.

Arizona recognises a HIPAA exemption. If you are a covered entity and you comply fully with the federal breach notification requirements, you can be deemed compliant with the state notice requirement for protected health information.

The trap is the word fully. You have to meet all of the federal requirements, and HIPAA own standard is without unreasonable delay and in no case later than 60 days. Relying on the exemption while quietly taking 58 days is a risk, because the state 45 day expectation sits underneath it and the exemption depends on your federal compliance being complete.

The safe practical position for an Arizona practice is to work to 45 days and treat the federal 60 as an outer limit you never approach.

What to do before anything happens

Know who determines that a breach occurred, because that person starts the clock. Know who drafts notifications and who signs them. Know where your patient contact data lives and whether you could actually produce a mailing list quickly.

Every one of those questions is easy in October and very hard on the day.