Q: Statute: Liability of health care provider for unreasonable delay disclose security breach

A: Under California law, the statute that defines the liability of a health care provider for an unreasonable delay in disclosing a security breach is the California Civil Code § 1798.82. This statute mandates that any person or business that conducts business in California and owns or licenses computerized data that includes personal information must disclose any security breach of such data to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Failure to comply with this requirement can result in legal liability for the health care provider, including possible penalties and damages for any harm caused to the affected individuals.

If you are facing issues with a health care provider's delay in disclosing a security breach, it is crucial to understand your rights under this statute. The law is designed to protect individuals from harm resulting from such breaches, ensuring timely notification and transparency. You may need to seek legal advice to explore your options and determine the best course of action to address any harm caused by the delay.