Cybersecurity incident disclosure

Healthcare and Life Sciences organizations face overlapping cybersecurity incident disclosure obligations from the U.S. Department of Health and Human Services Office for Civil Rights, the U.S. Securities and Exchange Commission, and the Cybersecurity and Infrastructure Security Agency, each operating on different timelines and breach thresholds. The SEC's 2023 cybersecurity disclosure rules require public companies to report material incidents within four business days on Form 8-K, a standard that sits in direct tension with HHS OCR's 60-day HIPAA breach notification window. Compliance teams in this sector are currently working through which incidents trigger both regimes simultaneously and how to draft disclosures that satisfy each agency without creating contradictions in the public record.