MT · Breach notification statute
Montana data breach notification law
Summary
- Statute citation
This state has 3 separate breach notification statutes
Private Sector: Mont. Code Ann. §§ 30-14-1701, 30-14-1702, 30-14-1704 (Unfair Trade
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Without unreasonable delay Montana requires businesses to notify affected individuals without
Attorney general notice
Yes Montana requires AG notification simultaneously with individual notification for all breaches across all
What counts as a breach
In Montana 'breach of the security of the data system' means unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by the person or business and causes or is reasonably believed to cause loss or injury to a Montana resident. Good faith acquisition of personal information by an employee or agent for the purposes of the person or business is not a breach, provided that the personal information is not
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Montana
36 reports to HHS OCR affecting 1,865,004 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Montana.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Montana Department of Public Health & Human Services | Health Plan | 1,062,509 | Jul 7, 2014 | Hacking/IT Incident | Archive (closed) |
| Logan Health Medical Center | Healthcare Provider | 213,543 | Feb 22, 2022 | Hacking/IT Incident | Archive (closed) |
| Kalispell Regional Healthcare | Healthcare Provider | 149,661 | Oct 22, 2019 | Hacking/IT Incident | Archive (closed) |
| Western Montana Mental Health Center | Healthcare Provider | 86,758 | Nov 14, 2024 | Hacking/IT Incident | Archive (closed) |
| Benefis Hospitals Inc | Healthcare Provider | 81,043 | Jul 27, 2021 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Montana businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Montana timing rule as: "Without unreasonable delay Montana requires businesses to notify affected individuals without". (Source: PRC 2026 survey extract.)
Does Montana require notice to the attorney general?
The PRC 2026 extract notes: "Yes Montana requires AG notification simultaneously with individual notification for all breaches across all". (Source: PRC 2026 survey extract.)
Does the Montana law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Montana breach law.
Does the Montana law cover medical information?
Yes. The PRC 2026 survey records medical information as covered by the Montana breach law.
Does the Montana law cover paper records?
No. The PRC 2026 survey records the Montana law as covering computerised data only, not paper records.
Is there a private right of action in Montana?
Yes. The PRC 2026 survey records a private right of action under the Montana breach law.
Is credit monitoring required in Montana?
No. The PRC 2026 survey does not record a credit monitoring requirement in Montana.
How does the Montana law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Montana statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Montana state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws