Skip to content
Network USA

OR · Breach notification statute

Oregon data breach notification law

A summary of the Oregon breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Or. Rev. Stat. §§ 646A.600-646A.628 (Oregon Consumer Information Protection Act) (amended

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

45 days Oregon requires covered entities (including businesses) to notify affected consumers within 45

Attorney general notice

Yes Oregon requires Attorney General notification when a breach affects more than 250 consumers;

What counts as a breach

In Oregon 'breach of security' means an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains or possesses. 'Breach of security' does not include an inadvertent acquisition of personal information by a person or the person's employee or agent if the personal information is not used in violation of applicable law or in a manner that harms or poses an actual threat to the security, confid

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Oregon

120 reports to HHS OCR affecting 5,405,904 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Oregon.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Performance Health TechnologyBusiness Associate1,752,076Aug 15, 2023Hacking/IT IncidentArchive (closed)
Oregon Anesthesiology Group, P.C.Healthcare Provider750,500Dec 6, 2021Hacking/IT IncidentArchive (closed)
Health Share of OregonHealth Plan654,362Feb 5, 2020TheftArchive (closed)
Oregon Department of Human ServicesBusiness Associate625,000Mar 22, 2019Hacking/IT IncidentArchive (closed)
Avamere Health Services, LLCBusiness Associate229,460Jul 13, 2022Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Oregon businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Oregon timing rule as: "45 days Oregon requires covered entities (including businesses) to notify affected consumers within 45". (Source: PRC 2026 survey extract.)

Does Oregon require notice to the attorney general?

The PRC 2026 extract notes: "Yes Oregon requires Attorney General notification when a breach affects more than 250 consumers;". (Source: PRC 2026 survey extract.)

Does the Oregon law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Oregon breach law.

Does the Oregon law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Oregon breach law.

Does the Oregon law cover paper records?

No. The PRC 2026 survey records the Oregon law as covering computerised data only, not paper records.

Is there a private right of action in Oregon?

Yes. The PRC 2026 survey records a private right of action under the Oregon breach law.

Is credit monitoring required in Oregon?

No. The PRC 2026 survey does not record a credit monitoring requirement in Oregon.

How does the Oregon law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Oregon statute, and see our HIPAA vs state breach notification laws guide.

Sources