On September 2, 2026, HB 381 was signed into law and amends Delaware’s data breach notification statute effective immediately. The new Delaware breach law includes a 60-day notice provision to the Delaware Attorney General, narrows the safe harbor for institutions covered by the Gramm-Leach-Bliley Act (GLBA) and entities regulated under HIPAA, and adds the Delaware Attorney General as part of a substitute notice process.
HB 381 enhances and expands Delaware’s data breach notification requirements. Under the new law, businesses that experience a data breach must notify the Delaware Attorney General within 60 days after determining that a breach has occurred even when a business cannot, despite reasonable diligence, identify which Delaware residents were affected.
Why Must Organizations Notify the Attorney General?
HIPAA-covered entities, such as hospitals, physician groups, and health care providers, and HIPAA business associates across the country continue to face cyber threats targeting protected health information (PHI). The enactment of HB 381 now forces organizations holding information on Delaware residents, including health care providers, to potentially report complex or ongoing forensic investigations to the Delaware Attorney General before an investigation may be complete. Under the prior version of the statute, organizations could wait for the conclusion of a forensic investigation, which can often take weeks or months, before notifying affected individuals. HB 381 does not change the requirement that the Delaware Attorney General be notified when the affected number of Delaware residents from a breach exceeds 500 individuals. Instead, HB 381’s early reporting and substitute notice requirements operate in addition to the existing statutory requirement.
What Does HB 381 Mean for Organizations Regulated by HIPAA or the GLBA?
Under Delaware’s HB 381, compliance with federal HIPAA or GLBA breach-notification rules no longer provides a blanket exemption from Delaware’s state-level requirements. Instead, compliance with a federal regulator’s breach procedures now satisfies only Delaware’s 60-day timing requirement, but organizations remain subject to the other provisions of the state’s breach notification laws. Regulated organizations must evaluate, for example, Delaware’s Attorney General notification requirement for breaches affecting more than 500 Delaware residents and Delaware’s credit monitoring requirement for certain breaches involving Social Security numbers. And beyond Delaware law, regulated entities must continue to evaluate their early regulator notification obligations under federal law.
What Steps Should Organizations Take in Response to HB 381?
Health care providers holding information on Delaware residents should review their incident response plans to ensure compliance with HB 381’s 60-day notification requirement for notifying the Delaware Attorney General’s office of a breach. HB 381 also serves as a reminder that such companies should evaluate their data governance as well as systems and protocols they rely on to prevent computer security breaches. Similarly, for providers that maintain protected health information, HB 381 reinforces the importance of documenting investigative efforts, breach-impact assessments, and decisions made during a cybersecurity incident.
Saul Ewing attorneys assist HIPAA-covered entities and business associates with HIPAA compliance and with incident response activities. For questions about this alert, please contact Bruce Armon, Head, Health Care Practice; Evan Foster, Head, Cybersecurity and Privacy Practice; Jazmine King, Associate, Commercial & Business Litigation Practice, or any other Saul Ewing attorney with which you interact.
