IA ยท Breach notification statute
Iowa data breach notification law
Summary
- Statute citation
Iowa Code Ch. 715C (Personal Information Security Breach Protection) (amended 2018)
- Last amended
- 2018 (as stated in the citation)
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
without unreasonable delay Iowa requires businesses to notify in the
Attorney general notice
Yes Iowa requires AG notification (Consumer Protection Division) within 5 business days after consumer
What counts as a breach
In Iowa 'breach of security' means unauthorized acquisition of personal information maintained in computerized form that compromises the security, confidentiality, or integrity of the personal information. It also means unauthorized acquisition of personal information in any medium, including paper, that was transferred from computerized form. 1
What counts as personal information
In Iowa 'personal information' means an individual's first name or first initial and last name in combination with: (1) Social security number; (2) Driver's license number or other unique government- issued ID; (3) Financial account number with access credentials; (4) Unique electronic identifier or routing code with access credentials; (5) Unique biometric data.2
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Iowa
100 reports to HHS OCR affecting 6,614,525 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Iowa.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Iowa Health System d/b/a UnityPoint Health | Business Associate | 1,421,107 | Jul 30, 2018 | Hacking/IT Incident | Archive (closed) |
| PurFoods, LLC | Healthcare Provider | 1,289,643 | Aug 25, 2023 | Hacking/IT Incident | Archive (closed) |
| OpenLoop Health, Inc. | Business Associate | 716,000 | Mar 17, 2026 | Hacking/IT Incident | Under investigation |
| Wolfe Clinic, P.C. | Healthcare Provider | 530,299 | Sep 9, 2022 | Hacking/IT Incident | Archive (closed) |
| Wolfe Clinic, P.C. | Healthcare Provider | 499,779 | Apr 9, 2021 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Iowa businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Iowa timing rule as: "without unreasonable delay Iowa requires businesses to notify in the". (Source: PRC 2026 survey extract.)
Does Iowa require notice to the attorney general?
The PRC 2026 extract notes: "Yes Iowa requires AG notification (Consumer Protection Division) within 5 business days after consumer". (Source: PRC 2026 survey extract.)
Does the Iowa law cover biometric data?
Yes. The PRC 2026 survey records biometric data as covered by the Iowa breach law.
Does the Iowa law cover medical information?
No. The PRC 2026 survey does not record medical information as covered by the Iowa breach law.
Does the Iowa law cover paper records?
Yes. The PRC 2026 survey records paper (non-computerised) records as covered in Iowa.
Is there a private right of action in Iowa?
No. The PRC 2026 survey does not record a private right of action under the Iowa breach law.
Is credit monitoring required in Iowa?
No. The PRC 2026 survey does not record a credit monitoring requirement in Iowa.
How does the Iowa law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Iowa statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Iowa state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws