Skip to content
Network USA

NE · Breach notification statute

Nebraska data breach notification law

A summary of the Nebraska breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Neb. Rev. Stat. §§ 87-801 to 87-808 (Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006) (amended 2018)

Last amended
2018 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

notify affected residents as soon as possible and without unreasonable delay following completion of

Attorney general notice

Yes Nebraska requires Attorney General notification concurrent with notification to affected residents for

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Nebraska

60 reports to HHS OCR affecting 5,403,241 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Nebraska.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
A&A Services d/b/a Sav-RxBusiness Associate2,812,336May 24, 2024Hacking/IT IncidentArchive (closed)
ALN Medical Management, LLCBusiness Associate1,323,720May 23, 2024Hacking/IT IncidentArchive (closed)
Regional Care, Inc.Healthcare Clearing House225,728Dec 17, 2024Hacking/IT IncidentArchive (closed)
The Nebraska Medical Center and University of Nebraska Medical Center, Affiliated Covered EntitiesHealthcare Provider216,472Nov 23, 2020Hacking/IT IncidentArchive (closed)
Signature Performance, Inc.Business Associate130,228Jun 10, 2024Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Nebraska businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Nebraska timing rule as: "notify affected residents as soon as possible and without unreasonable delay following completion of". (Source: PRC 2026 survey extract.)

Does Nebraska require notice to the attorney general?

The PRC 2026 extract notes: "Yes Nebraska requires Attorney General notification concurrent with notification to affected residents for". (Source: PRC 2026 survey extract.)

Does the Nebraska law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Nebraska breach law.

Does the Nebraska law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Nebraska breach law.

Does the Nebraska law cover paper records?

No. The PRC 2026 survey records the Nebraska law as covering computerised data only, not paper records.

Is there a private right of action in Nebraska?

No. The PRC 2026 survey does not record a private right of action under the Nebraska breach law.

Is credit monitoring required in Nebraska?

No. The PRC 2026 survey does not record a credit monitoring requirement in Nebraska.

How does the Nebraska law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Nebraska statute, and see our HIPAA vs state breach notification laws guide.

Sources