Data breach notification

Healthcare and life sciences companies face data breach notification obligations across a patchwork of overlapping federal and state authorities, with the U.S. Department of Health and Human Services Office for Civil Rights enforcing the HIPAA Breach Notification Rule and the U.S. Federal Trade Commission asserting jurisdiction over non-covered entities under the Health Breach Notification Rule, which was substantially updated in 2024 to capture health apps and connected devices. State attorneys general are layering additional timelines and recipient-class requirements on top of federal floors, leaving compliance teams to reconcile conflicting clocks across jurisdictions before a single breach notice goes out.