Skip to content
Network USA

VT · Breach notification statute

Vermont data breach notification law

A summary of the Vermont breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

9 V.S.A. §§ 2430, 2435 (Security Breach Notice Act) (amended 2020)

Last amended
2020 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

45 days Vermont requires businesses to notify affected consumers in the most expedient time possible

Attorney general notice

Yes Vermont requires notification to the Attorney General (or Department of Financial Regulation for

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Vermont

16 reports to HHS OCR affecting 201,678 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Vermont.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Rutland Hospital, Inc. d/b/a/ Rutland Regional Medical CenterHealthcare Provider72,224Feb 20, 2019Hacking/IT IncidentArchive (closed)
Lamoille Health PartnersHealthcare Provider59,381Aug 11, 2022Hacking/IT IncidentArchive (closed)
Central Vermont Eye CareHealthcare Provider29,892Apr 6, 2022Hacking/IT IncidentArchive (closed)
The Richards GroupBusiness Associate15,429Jan 28, 2021Hacking/IT IncidentArchive (closed)
Gifford Health CareHealthcare Provider6,777Apr 23, 2021Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Vermont businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Vermont timing rule as: "45 days Vermont requires businesses to notify affected consumers in the most expedient time possible". (Source: PRC 2026 survey extract.)

Does Vermont require notice to the attorney general?

The PRC 2026 extract notes: "Yes Vermont requires notification to the Attorney General (or Department of Financial Regulation for". (Source: PRC 2026 survey extract.)

Does the Vermont law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Vermont breach law.

Does the Vermont law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Vermont breach law.

Does the Vermont law cover paper records?

No. The PRC 2026 survey records the Vermont law as covering computerised data only, not paper records.

Is there a private right of action in Vermont?

Yes. The PRC 2026 survey records a private right of action under the Vermont breach law.

Is credit monitoring required in Vermont?

No. The PRC 2026 survey does not record a credit monitoring requirement in Vermont.

How does the Vermont law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Vermont statute, and see our HIPAA vs state breach notification laws guide.

Sources