Skip to content
Network USA

WV · Breach notification statute

West Virginia data breach notification law

A summary of the West Virginia breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

W. Va. Code §§ 46A-2A-101 to -105 (Consumer Credit and Protection Act - Breach of Security of Consumer Information) (amended 2008)

Last amended
2008 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Without unreasonable delay West Virginia requires businesses and individuals to notify affected

Attorney general notice

No West Virginia does not require notification to the Attorney General or any state agency for data

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in West Virginia

49 reports to HHS OCR affecting 1,850,823 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in West Virginia.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Monongalia Health System, Inc.Healthcare Provider492,861Feb 28, 2022Hacking/IT IncidentArchive (closed)
Monongalia Health System, Inc.Healthcare Provider398,164Dec 21, 2021Hacking/IT IncidentArchive (closed)
Health Care Management Solutions, LLCBusiness Associate254,000Nov 14, 2022Hacking/IT IncidentArchive (closed)
Physician’s Business Office, Inc.Business Associate196,673Sep 23, 2022Hacking/IT IncidentArchive (closed)
Regional Eye Associates, Inc. & Surgical Eye Center of MorgantownHealthcare Provider194,035Apr 28, 2022Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must West Virginia businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the West Virginia timing rule as: "Without unreasonable delay West Virginia requires businesses and individuals to notify affected". (Source: PRC 2026 survey extract.)

Does West Virginia require notice to the attorney general?

The PRC 2026 extract notes: "No West Virginia does not require notification to the Attorney General or any state agency for data". (Source: PRC 2026 survey extract.)

Does the West Virginia law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the West Virginia breach law.

Does the West Virginia law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the West Virginia breach law.

Does the West Virginia law cover paper records?

No. The PRC 2026 survey records the West Virginia law as covering computerised data only, not paper records.

Is there a private right of action in West Virginia?

No. The PRC 2026 survey does not record a private right of action under the West Virginia breach law.

Is credit monitoring required in West Virginia?

No. The PRC 2026 survey does not record a credit monitoring requirement in West Virginia.

How does the West Virginia law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the West Virginia statute, and see our HIPAA vs state breach notification laws guide.

Sources