IN ยท Breach notification statute
Indiana data breach notification law
Summary
- Statute citation
Statute citation not extracted; see the state legislature website.
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Not applicable - state agencies exempt Indiana explicitly exempts state agencies from the breach
Attorney general notice
Yes Indiana requires notification to the Attorney General for all breaches that require disclosure to
What counts as a breach
Not extracted in our PRC 2026 summary; check the statute.
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Indiana
204 reports to HHS OCR affecting 93,117,155 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Indiana.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Anthem Inc. | Health Plan | 78,800,000 | Feb 13, 2015 | Hacking/IT Incident | Archive (closed) |
| Medical Informatics Engineering | Business Associate | 3,500,000 | Jul 23, 2015 | Hacking/IT Incident | Archive (closed) |
| Apria Healthcare LLC | Healthcare Provider | 1,868,831 | May 16, 2022 | Hacking/IT Incident | Archive (closed) |
| Eskenazi Health | Healthcare Provider | 1,515,918 | Oct 1, 2021 | Hacking/IT Incident | Archive (closed) |
| Community Health Network, Inc. as an Affiliated Covered Entity | Healthcare Provider | 1,500,000 | Nov 18, 2022 | Unauthorized Access/Disclosure | Archive (closed) |
Frequently asked questions
When must Indiana businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Indiana timing rule as: "Not applicable - state agencies exempt Indiana explicitly exempts state agencies from the breach". (Source: PRC 2026 survey extract.)
Does Indiana require notice to the attorney general?
The PRC 2026 extract notes: "Yes Indiana requires notification to the Attorney General for all breaches that require disclosure to". (Source: PRC 2026 survey extract.)
Does the Indiana law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Indiana breach law.
Does the Indiana law cover medical information?
No. The PRC 2026 survey does not record medical information as covered by the Indiana breach law.
Does the Indiana law cover paper records?
Yes. The PRC 2026 survey records paper (non-computerised) records as covered in Indiana.
Is there a private right of action in Indiana?
No. The PRC 2026 survey does not record a private right of action under the Indiana breach law.
Is credit monitoring required in Indiana?
No. The PRC 2026 survey does not record a credit monitoring requirement in Indiana.
How does the Indiana law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Indiana statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Indiana state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws