PA · Breach notification statute
Pennsylvania data breach notification law
Summary
- Statute citation
73 P.S. §§ 2301-2330 (Breach of Personal Information Notification Act) (amended 2024)
- Last amended
- 2024 (as stated in the citation)
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
notify affected individuals within 7 business days following determination of a breach. 34
Attorney general notice
Yes Pennsylvania requires AG notification when more than 500 individuals in the Commonwealth are
What counts as a breach
Not extracted in our PRC 2026 summary; check the statute.
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Pennsylvania
345 reports to HHS OCR affecting 21,205,627 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Pennsylvania.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| AdaptHealth, LLC | Healthcare Provider | 4,115,802 | Aug 14, 2026 | Hacking/IT Incident | Under investigation |
| Connexin Software, Inc. | Business Associate | 2,846,039 | Nov 11, 2022 | Hacking/IT Incident | Archive (closed) |
| Geisinger | Healthcare Provider | 1,276,026 | Jun 21, 2024 | Unauthorized Access/Disclosure | Archive (closed) |
| Iron Mountain Data Products, Inc. (now known as | Business Associate | 800,000 | Jul 19, 2010 | Loss | Archive (closed) |
| Allegheny County | Healthcare Provider | 689,686 | Jul 28, 2023 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Pennsylvania businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Pennsylvania timing rule as: "notify affected individuals within 7 business days following determination of a breach. 34". (Source: PRC 2026 survey extract.)
Does Pennsylvania require notice to the attorney general?
The PRC 2026 extract notes: "Yes Pennsylvania requires AG notification when more than 500 individuals in the Commonwealth are". (Source: PRC 2026 survey extract.)
Does the Pennsylvania law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Pennsylvania breach law.
Does the Pennsylvania law cover medical information?
Yes. The PRC 2026 survey records medical information as covered by the Pennsylvania breach law.
Does the Pennsylvania law cover paper records?
No. The PRC 2026 survey records the Pennsylvania law as covering computerised data only, not paper records.
Is there a private right of action in Pennsylvania?
No. The PRC 2026 survey does not record a private right of action under the Pennsylvania breach law.
Is credit monitoring required in Pennsylvania?
Yes. The PRC 2026 survey records a credit monitoring requirement in Pennsylvania.
How does the Pennsylvania law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Pennsylvania statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Pennsylvania state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws