Skip to content
Network USA

OH · Breach notification statute

Ohio data breach notification law

A summary of the Ohio breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

This state has 2 separate breach notification statutes

Private Sector: Ohio Rev. Code § 1349.19 (Consumer Protection - Private Disclosure of

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

45 days Ohio requires businesses and persons to notify affected individuals in the most expedient time

Attorney general notice

No Ohio does not require entities to notify the Attorney General or any state agency of data breaches; the

What counts as a breach

In Ohio 'breach of the security of the system' means unauthorized access to and acquisition of computerized data that compromises the security or confidentiality of personal information owned or licensed by a person and that causes, reasonably is believed to have caused, or reasonably is believed will cause a material risk of identity theft or other fraud to the person or property of a resident of this state. Good faith acquisition by an employee or agent for the purposes of the person is not a

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Ohio

278 reports to HHS OCR affecting 18,927,883 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Ohio.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Unlimited Technology Systems, LLCBusiness Associate3,803,750Jul 21, 2026Hacking/IT IncidentUnder investigation
CareSourceBusiness Associate3,180,537Jul 27, 2023Hacking/IT IncidentArchive (closed)
Kettering Adventist HealthcareHealthcare Provider1,695,382Jul 21, 2025Hacking/IT IncidentUnder investigation
The Kroger Co.Healthcare Provider1,474,284Feb 19, 2021Hacking/IT IncidentArchive (closed)
EyeMed Vision Care LLCBusiness Associate1,474,000Sep 28, 2020Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Ohio businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Ohio timing rule as: "45 days Ohio requires businesses and persons to notify affected individuals in the most expedient time". (Source: PRC 2026 survey extract.)

Does Ohio require notice to the attorney general?

The PRC 2026 extract notes: "No Ohio does not require entities to notify the Attorney General or any state agency of data breaches; the". (Source: PRC 2026 survey extract.)

Does the Ohio law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Ohio breach law.

Does the Ohio law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Ohio breach law.

Does the Ohio law cover paper records?

No. The PRC 2026 survey records the Ohio law as covering computerised data only, not paper records.

Is there a private right of action in Ohio?

No. The PRC 2026 survey does not record a private right of action under the Ohio breach law.

Is credit monitoring required in Ohio?

No. The PRC 2026 survey does not record a credit monitoring requirement in Ohio.

How does the Ohio law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Ohio statute, and see our HIPAA vs state breach notification laws guide.

Sources