Skip to content
Network USA

HI ยท Breach notification statute

Hawaii data breach notification law

A summary of the Hawaii breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Statute citation not extracted; see the state legislature website.

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Without unreasonable delay Hawaii requires businesses to notify affected persons without unreasonable

Attorney general notice

Yes Hawaii requires notification to the State of Hawaii's Office of Consumer Protection when a business

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

In Hawaii 'personal information' means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: (1) Social security number; (2) Driver's license number or Hawaii identification card number; or (3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account. Personal information does not include pu

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsYes
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Hawaii

24 reports to HHS OCR affecting 614,294 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Hawaii.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Orthopedic Associates of HawaiiHealthcare Provider138,000Apr 20, 2021Hacking/IT IncidentArchive (closed)
Community Clinic of Maui, Inc. dba Malama I Ke Ola Health CenterHealthcare Provider123,816Sep 26, 2024Hacking/IT IncidentArchive (closed)
Hawaii Dental Group, Inc DBA Hawaii Family DentalHealthcare Provider45,853Aug 21, 2026Hacking/IT IncidentUnder investigation
Hawaii Radiologic Associates, Ltd.Healthcare Provider43,916Oct 25, 2024Hacking/IT IncidentArchive (closed)
Aloha Laser VisionHealthcare Provider43,263Jun 17, 2022Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Hawaii businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Hawaii timing rule as: "Without unreasonable delay Hawaii requires businesses to notify affected persons without unreasonable". (Source: PRC 2026 survey extract.)

Does Hawaii require notice to the attorney general?

The PRC 2026 extract notes: "Yes Hawaii requires notification to the State of Hawaii's Office of Consumer Protection when a business". (Source: PRC 2026 survey extract.)

Does the Hawaii law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Hawaii breach law.

Does the Hawaii law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Hawaii breach law.

Does the Hawaii law cover paper records?

Yes. The PRC 2026 survey records paper (non-computerised) records as covered in Hawaii.

Is there a private right of action in Hawaii?

Yes. The PRC 2026 survey records a private right of action under the Hawaii breach law.

Is credit monitoring required in Hawaii?

No. The PRC 2026 survey does not record a credit monitoring requirement in Hawaii.

How does the Hawaii law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Hawaii statute, and see our HIPAA vs state breach notification laws guide.

Sources