NV · Breach notification statute
Nevada data breach notification law
Summary
- Statute citation
Nev. Rev. Stat. §§ 603A.010 to 603A.290 (Security and Privacy of Personal Information) (amended
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Most expedient time possible and without unreasonable delay Nevada requires businesses (data
Attorney general notice
No Nevada's breach notification statute does not require notification to the Attorney General or any state
What counts as a breach
In Nevada 'breach of the security of the system data' means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information maintained by the data collector. The term does not include the good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, so long as the personal information is not used for a purpose unrelated to the data collector
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Nevada
55 reports to HHS OCR affecting 12,507,230 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Nevada.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Perry Johnson & Associates, Inc. dba PJ&A | Business Associate | 9,302,588 | Nov 3, 2023 | Hacking/IT Incident | Archive (closed) |
| University Medical Center of Southern Nevada | Healthcare Provider | 1,300,000 | Aug 13, 2021 | Hacking/IT Incident | Archive (closed) |
| Absolute Dental Group, LLC | Business Associate | 1,223,635 | May 2, 2025 | Hacking/IT Incident | Under investigation |
| Laboratory Medicine Consultants, Ltd. | Healthcare Provider | 140,590 | Jul 25, 2019 | Hacking/IT Incident | Archive (closed) |
| Renown Health | Healthcare Provider | 65,181 | Jun 22, 2021 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Nevada businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Nevada timing rule as: "Most expedient time possible and without unreasonable delay Nevada requires businesses (data". (Source: PRC 2026 survey extract.)
Does Nevada require notice to the attorney general?
The PRC 2026 extract notes: "No Nevada's breach notification statute does not require notification to the Attorney General or any state". (Source: PRC 2026 survey extract.)
Does the Nevada law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Nevada breach law.
Does the Nevada law cover medical information?
Yes. The PRC 2026 survey records medical information as covered by the Nevada breach law.
Does the Nevada law cover paper records?
No. The PRC 2026 survey records the Nevada law as covering computerised data only, not paper records.
Is there a private right of action in Nevada?
Yes. The PRC 2026 survey records a private right of action under the Nevada breach law.
Is credit monitoring required in Nevada?
No. The PRC 2026 survey does not record a credit monitoring requirement in Nevada.
How does the Nevada law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Nevada statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Nevada state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws