Skip to content
Network USA

OK · Breach notification statute

Oklahoma data breach notification law

A summary of the Oklahoma breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

This state has 2 separate breach notification statutes

Private Sector: 24 Okla. Stat. §§ 161-166 (Security Breach Notification Act) (amended 2025)

Last amended
2025 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Without unreasonable delay Oklahoma requires individuals and businesses to notify affected individuals

Attorney general notice

notifications on a public website?

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Oklahoma

83 reports to HHS OCR affecting 6,107,720 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Oklahoma.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
INTEGRIS HealthHealthcare Provider2,385,646Jan 26, 2024Hacking/IT IncidentArchive (closed)
INTEGRIS Health, Inc.Healthcare Provider1,245,218Dec 16, 2019LossArchive (closed)
Emergency Medical Services AuthorityHealthcare Provider611,743Mar 22, 2024Hacking/IT IncidentArchive (closed)
Oklahoma State UniversityHealthcare Provider279,865Jan 5, 2018Hacking/IT IncidentArchive (closed)
Avem Health PartnersBusiness Associate271,303Dec 13, 2022Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Oklahoma businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Oklahoma timing rule as: "Without unreasonable delay Oklahoma requires individuals and businesses to notify affected individuals". (Source: PRC 2026 survey extract.)

Does Oklahoma require notice to the attorney general?

The PRC 2026 extract notes: "notifications on a public website?". (Source: PRC 2026 survey extract.)

Does the Oklahoma law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Oklahoma breach law.

Does the Oklahoma law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Oklahoma breach law.

Does the Oklahoma law cover paper records?

No. The PRC 2026 survey records the Oklahoma law as covering computerised data only, not paper records.

Is there a private right of action in Oklahoma?

No. The PRC 2026 survey does not record a private right of action under the Oklahoma breach law.

Is credit monitoring required in Oklahoma?

No. The PRC 2026 survey does not record a credit monitoring requirement in Oklahoma.

How does the Oklahoma law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Oklahoma statute, and see our HIPAA vs state breach notification laws guide.

Sources