If your company has customers in Colorado, get ready to revamp your policies notifying victims of a data breach. Last week, Gov. John Hickenlooper signed into law requirements for notification that are the most stringent in the nation.
Under the new law, if an individual’s personal information is part of a breach, he must be notified within 30 days after discovery — no exceptions. In addition, the law, passed with bipartisan support, broadens the definition of personally identifying information to including health care and financial data.
The new notification requirement will have a special impact on organizations that must notify individuals of a HIPAA breach because it takes precedence over the federal 60-day notification window.
Notification requirements include telling affected individuals which data was released and the estimated data of the breach.
Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio