Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When one incident triggers HIPAA, State law and a customer contract, which clock runs first?

4 decision pointsThe pack behind this answer: Regulatory Incident Notification & Reporting

Add to board memo

The short answer

Recommendation
Set each clock from its own start, put every due time in one calendar in order, and notify in due-time order from one fact base: the first notice due is often a contract or a State, not HIPAA.
Reasoning
HIPAA's 60 calendar days are the longest clock in the set and the best known, so teams plan around it and miss the shorter ones. A contract can ask for notice within days or hours, a State can ask for 30 days, a listed company has four business days from the materiality determination, and a New York licensee has 72 hours from its determination. Each clock also starts from a different event, so the same incident has several dates in the calendar.
Considerations
  • The EU clocks, if they apply too, run from awareness: see “When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?”.
  • A notice under one regime never satisfies another, and a notice to one body never waits for another.
  • A law-enforcement request can delay HIPAA notice only in the form the rule requires: a written statement for the period it names, or an oral one documented and good for at most 30 days.
  • Contracts, insurers and the police have no legal clock but may be the first due.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartOne incident has opened several notice dutiesStepFind the discovery time, then the declaration timeStepList each regime and contract and the event its clock starts fromDecisionDoes any contract give less time than the law?StepPut the contract's time first and meet itDecisionDoes any State give less than 60 days?StepPut the State's date before HIPAA'sDecisionAre we listed, or licensed in New York?StepPut the SEC and New York dates in the calendarStepPut every due time in one calendar, earliest firstDecisionHas law enforcement asked us to wait?StepRecord who asked, when, in what form and for how longStepDraft every notice from one fact baseOutcomeNotify in due-time order, each on its own clock

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    One incident has opened several notice duties

    A single incident can reach protected health information, residents of several States, a customer's contract and, for a listed or licensed company, the SEC and New York. Each has its own recipient, its own deadline and its own start. Treat the calendar as the answer: the order of the laws tells you nothing about the order of the dates.

    In the pack

  2. Step

    Find the discovery time, then the declaration time

    HIPAA and the FTC's Health Breach Notification Rule count from discovery: the first day anyone in the workforce or any agent knew or with reasonable diligence would have known (the Safeguards Rule counts what is known to you, and State laws as each State says). The incident may have been declared a day or more later. Use the earlier time for these clocks, and record both.

    In the pack

  3. Step

    List each regime and contract and the event its clock starts from

    For each regime in the profile write the event its clock starts from: discovery for HIPAA, State law and the FTC; the materiality determination for the SEC; the determination that a cybersecurity incident occurred for New York; the payment for an extortion notice. Add each customer contract, business associate agreement and insurer, with the time it gives.

    In the pack

  4. Decision

    Does any contract give less time than the law?

    A customer contract or business associate agreement often asks for notice within hours or a few days of discovery. A business associate has 60 days under HIPAA to tell the covered entity, but its agreement usually sets a shorter time. If a contract is shorter, it is the first date in the calendar, and a contract notice is not a legal notice.

    In the pack

  5. Step

    Put the contract's time first and meet it

    Notify the customer in the contract's time, from the approved customer notice (the pack's customer notice, CT-04), and log it. Keep going: the legal notices still have their own clocks, and the customer's own duties may depend on your notice.

    In the pack

  6. Decision

    Does any State give less than 60 days?

    Read each State's current text. The pack's examples, California and New York, give 30 days as read on 20 October 2026 (California in the Legislature's chaptered text of SB 446, Chapter 319 of 2025), counted differently and with notice to their attorneys general in addition: confirm each with counsel. Another State may give less. Where residents of several States are affected, plan to the shortest deadline among them.

    In the pack

  7. Step

    Put the State's date before HIPAA's

    Enter the State's date from its own start, add any notice to its attorney general or regulator, and plan the first notice to individuals in that State to it. HIPAA's 60 days remain the outer limit for the rest.

    In the pack

  8. Decision

    Are we listed, or licensed in New York?

    A listed company has four business days from its materiality determination, and a New York licensee 72 hours from determining that a cybersecurity incident has occurred. Both can fall before HIPAA's 60 days and before a State's 30. If neither applies, skip to the calendar.

    In the pack

  9. Step

    Put the SEC and New York dates in the calendar

    Count four business days for the Form 8-K from the determination, skipping weekends and the SEC's closed days, and 72 hours for New York from the determination of the incident. These are often the first legal dates in the calendar. “When do we have to disclose a cyber incident to the SEC as a listed company?” covers the materiality decision.

    In the pack

    See also

  10. Step

    Put every due time in one calendar, earliest first

    One calendar, ordered by due time, with the start event beside each date, in the diaries of the drafter and the signatory. The reminder is set at half the time remaining, the pack's default. Each submission sets the next due time.

    In the pack

  11. Decision

    Has law enforcement asked us to wait?

    Under HIPAA, a written statement that notice would impede a criminal investigation or damage national security delays notice for the time it names. An oral statement is documented, with the official's identity, and delays notice for no more than 30 days unless a written statement follows. Other regimes and States have their own rules on delay, or none.

    In the pack

  12. Step

    Record who asked, when, in what form and for how long

    Write it down at once, ask for it in writing, and move only the clocks the rule lets it move. Keep the determination of the other regimes on their own dates.

    In the pack

  13. Step

    Draft every notice from one fact base

    One record of the facts, the counts and the dates feeds every notice, so that the Form 8-K, New York, the individuals and the States say the same thing. A figure that differs because the regimes count differently says so.

    In the pack

  14. Outcome

    Notify in due-time order, each on its own clock

    Send each notice through its own channel before its own deadline, log the time and the recipient's reference, and set the next due time. No notice stands in for another, and none waits for another.

    In the pack

Practical checklist

  1. List every regime and contract the incident opens, and the event each clock starts from.
  2. Enter every due time in one calendar, earliest first, and give it to the drafter and the signatory.
  3. Check each State's current text for the deadline and what starts it, and look for a shorter time in each contract.
  4. Draft every notice from one fact base and send each through its own channel.
  5. Log each notice with its time and the recipient's reference, and set the next due time.

Evidence to have ready

  • The calendar of due times with the start event of each.
  • The discovery time and the declaration time in the case log.
  • The fact base and each notice drafted from it.
  • Any law-enforcement request, recorded as the rule requires.

Assumptions

  • More than one US duty, or a contract, applies to the incident, and you have an applicability profile that says which. The pack leaves State rows as placeholders; read each State's law.
  • Your customer contracts and business associate agreements record their notice periods; if they do not, find them now. Where the contract asks for less time than the law, the contract's time is the one that falls due first.
  • The legal deadlines are the ones the pack's US matrix states, as read on 18 October 2026. This is not legal advice.

Not covered here