Skip to content
Network USA

MO · Breach notification statute

Missouri data breach notification law

A summary of the Missouri breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Mo. Rev. Stat. § 407.1500 (Merchandising Practices - Security Breach Notification) (amended

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Without unreasonable delay Missouri requires businesses and persons to notify affected consumers

Attorney general notice

Yes Missouri requires Attorney General notification without unreasonable delay when a breach requires

What counts as a breach

In Missouri 'breach of security' or 'breach' means unauthorized access to and unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information. Good faith acquisition of personal information by a person or that person's employee or agent for a legitimate purpose of that person is not a breach of security, provided that the personal information is not used in violation of applicabl

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Missouri

167 reports to HHS OCR affecting 17,582,532 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Missouri.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Ascension HealthHealthcare Provider5,466,931Jul 3, 2024Hacking/IT IncidentArchive (closed)
TriZetto Provider SolutionsBusiness Associate3,433,965Feb 6, 2026Hacking/IT IncidentUnder investigation
Navvis & Company, LLCBusiness Associate2,824,726Sep 22, 2023Hacking/IT IncidentArchive (closed)
Missouri Department of Social ServicesHealth Plan739,884Aug 7, 2023Hacking/IT IncidentArchive (closed)
North Kansas City HospitalHealthcare Provider502,438Jan 3, 2024Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Missouri businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Missouri timing rule as: "Without unreasonable delay Missouri requires businesses and persons to notify affected consumers". (Source: PRC 2026 survey extract.)

Does Missouri require notice to the attorney general?

The PRC 2026 extract notes: "Yes Missouri requires Attorney General notification without unreasonable delay when a breach requires". (Source: PRC 2026 survey extract.)

Does the Missouri law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Missouri breach law.

Does the Missouri law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Missouri breach law.

Does the Missouri law cover paper records?

No. The PRC 2026 survey records the Missouri law as covering computerised data only, not paper records.

Is there a private right of action in Missouri?

No. The PRC 2026 survey does not record a private right of action under the Missouri breach law.

Is credit monitoring required in Missouri?

No. The PRC 2026 survey does not record a credit monitoring requirement in Missouri.

How does the Missouri law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Missouri statute, and see our HIPAA vs state breach notification laws guide.

Sources