Skip to content
Network USA

MA · Breach notification statute

Massachusetts data breach notification law

A summary of the Massachusetts breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Mass. Gen. Laws ch. 93H, §§ 1-6 (General Laws Chapter 93H - Security Breaches) (amended 2019)

Last amended
2019 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

notify affected individuals 'as soon as practicable and without unreasonable delay' with no specific day

Attorney general notice

Yes Massachusetts requires notification to both the Attorney General and the Director of Consumer

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsYes
Private right of actionYes
Credit monitoring requiredYes

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Massachusetts

245 reports to HHS OCR affecting 28,784,150 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Massachusetts.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
DentaQuest, LLCHealth Plan15,000,000Jul 16, 2026Hacking/IT IncidentUnder investigation
Harvard Pilgrim Health CareHealth Plan2,662,337May 24, 2023Hacking/IT IncidentArchive (closed)
Shields Health Care Group, Inc.Business Associate2,380,483May 27, 2022Hacking/IT IncidentArchive (closed)
Nuance Communications, Inc.Business Associate1,225,054Sep 15, 2023Hacking/IT IncidentArchive (closed)
ZOLL Services LLCHealthcare Provider997,097Mar 10, 2023Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Massachusetts businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Massachusetts timing rule as: "notify affected individuals 'as soon as practicable and without unreasonable delay' with no specific day". (Source: PRC 2026 survey extract.)

Does Massachusetts require notice to the attorney general?

The PRC 2026 extract notes: "Yes Massachusetts requires notification to both the Attorney General and the Director of Consumer". (Source: PRC 2026 survey extract.)

Does the Massachusetts law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Massachusetts breach law.

Does the Massachusetts law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Massachusetts breach law.

Does the Massachusetts law cover paper records?

Yes. The PRC 2026 survey records paper (non-computerised) records as covered in Massachusetts.

Is there a private right of action in Massachusetts?

Yes. The PRC 2026 survey records a private right of action under the Massachusetts breach law.

Is credit monitoring required in Massachusetts?

Yes. The PRC 2026 survey records a credit monitoring requirement in Massachusetts.

How does the Massachusetts law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Massachusetts statute, and see our HIPAA vs state breach notification laws guide.

Sources