Skip to content
Network USA

IL ยท Breach notification statute

Illinois data breach notification law

A summary of the Illinois breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Statute citation not extracted; see the state legislature website.

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

notify in the 'most expedient time possible and without unreasonable delay.' No specific numeric

Attorney general notice

Yes Illinois requires AG notification from data collectors (500+ residents) and State agencies (250+

What counts as a breach

In Illinois 'breach of the security of the system data' or 'breach' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector.1

What counts as personal information

In Illinois 'personal information' means either (1) name plus SSN, driver's license/state ID, financial account, medical information, health insurance information, or biometric data; or (2) username/email plus password or security Q&A for online account access.2

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Illinois

364 reports to HHS OCR affecting 22,594,404 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Illinois.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Advocate Health and Hospitals Corporation, d/b/a Advocate Medical GroupHealthcare Provider4,029,530Aug 23, 2013TheftArchive (closed)
Veradigm LLCBusiness Associate2,672,036Sep 22, 2025Hacking/IT IncidentUnder investigation
Cook County Health and Hospitals SystemHealthcare Provider1,248,546Sep 24, 2023Hacking/IT IncidentArchive (closed)
Superior Air-Ground Ambulance Service, Inc.Healthcare Provider1,039,972May 10, 2024Hacking/IT IncidentArchive (closed)
Ann & Robert H. Lurie Children's Hospital of ChicagoHealthcare Provider775,860Jun 27, 2024Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Illinois businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Illinois timing rule as: "notify in the 'most expedient time possible and without unreasonable delay.' No specific numeric". (Source: PRC 2026 survey extract.)

Does Illinois require notice to the attorney general?

The PRC 2026 extract notes: "Yes Illinois requires AG notification from data collectors (500+ residents) and State agencies (250+". (Source: PRC 2026 survey extract.)

Does the Illinois law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Illinois breach law.

Does the Illinois law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Illinois breach law.

Does the Illinois law cover paper records?

No. The PRC 2026 survey records the Illinois law as covering computerised data only, not paper records.

Is there a private right of action in Illinois?

Yes. The PRC 2026 survey records a private right of action under the Illinois breach law.

Is credit monitoring required in Illinois?

No. The PRC 2026 survey does not record a credit monitoring requirement in Illinois.

How does the Illinois law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Illinois statute, and see our HIPAA vs state breach notification laws guide.

Sources