Skip to content
Network USA

ID · Breach notification statute

Idaho data breach notification law

A summary of the Idaho breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Idaho Code §§ 28-51-104 to 28-51-107 (Commercial Transactions - Identity Theft) (amended

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Most expedient time possible without unreasonable delay Idaho requires businesses to notify affected

Attorney general notice

notifications on a public website?

What counts as a breach

In Idaho 'breach of the security of the system' means the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information for one or more persons maintained by an agency, individual or a commercial entity.1

What counts as personal information

In Idaho 'personal information' means an Idaho resident's first name or first initial and last name in combination with: (a) Social security number; (b) Driver's license number or Idaho identification card number; or (c) Account number, or credit or debit card number, with any required access code or password.2

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Idaho

32 reports to HHS OCR affecting 1,543,757 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Idaho.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Kootenai HealthHealthcare Provider464,088Apr 24, 2024Hacking/IT IncidentArchive (closed)
Mountain View HospitalHealthcare Provider441,903Jul 3, 2023Hacking/IT IncidentArchive (closed)
Saint Alphonsus Health SystemHealthcare Provider134,906Mar 4, 2021Hacking/IT IncidentArchive (closed)
NS Support, LLCHealthcare Provider92,845Nov 21, 2025Hacking/IT IncidentArchive (closed)
Boundary Regional Community Health Center dba Kaniksu Community HealthHealthcare Provider88,000Jul 21, 2026Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Idaho businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Idaho timing rule as: "Most expedient time possible without unreasonable delay Idaho requires businesses to notify affected". (Source: PRC 2026 survey extract.)

Does Idaho require notice to the attorney general?

The PRC 2026 extract notes: "notifications on a public website?". (Source: PRC 2026 survey extract.)

Does the Idaho law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Idaho breach law.

Does the Idaho law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Idaho breach law.

Does the Idaho law cover paper records?

No. The PRC 2026 survey records the Idaho law as covering computerised data only, not paper records.

Is there a private right of action in Idaho?

No. The PRC 2026 survey does not record a private right of action under the Idaho breach law.

Is credit monitoring required in Idaho?

No. The PRC 2026 survey does not record a credit monitoring requirement in Idaho.

How does the Idaho law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Idaho statute, and see our HIPAA vs state breach notification laws guide.

Sources