Delaware House Bill 381, signed into law on Sept. 2, 2026, amends the state’s data breach notification statute and clarifies when organizations must notify the Delaware Attorney General after a computer security breach.

 

What happened

Delaware signed House Bill 381 into law on Sept. 2, 2026. The law amends the state’s data breach notification statute in Chapter 12B of Title 6. It clarifies when organizations must notify the Delaware Attorney General following a computer security breach and strengthens state oversight of breach-response activities.

HB 381 narrows certain exemptions that previously applied to HIPAA-regulated entities. Health care providers already follow the federal breach notification requirements of the Health Insurance Portability and Accountability Act (HIPAA). Legal analyses of the bill indicate that health care organizations may no longer be able to rely only on HIPAA compliance to satisfy all Delaware notification obligations. Providers must now independently evaluate whether Delaware state reporting requirements are triggered after a cybersecurity event.

 

Going deeper

HB 381 addresses a common challenge in health care breaches, organizations may need weeks or months to determine which patients were affected. The law responds by clarifying Attorney General notification obligations when affected Delaware residents cannot be readily identified after a breach has been determined. As a result, the law places greater emphasis on early engagement with state regulators, even while a forensic investigation remains ongoing.

Delaware health care providers should review their incident-response plans to coordinate HIPAA breach notification requirements with Delaware’s revised state-law obligations. Compliance teams, privacy officers, information security personnel, and legal counsel should evaluate whether existing breach-response protocols adequately address:

  • Attorney General notification
  • Timing considerations
  • Substitute-notice procedures under Delaware law

HB 381 also shows the importance of documenting investigative efforts, patient-impact assessments, and decision-making processes during a cybersecurity incident.

 

What was said

Attorney General Kathy Jennings said HB 380 and HB 381 “modernize Delaware’s data privacy protections to keep pace with AI.” She made the statement in a House Democrats press release after the bill passed the House. She also thanked Rep. Krista Griffith, the bill’s House sponsor, for her leadership.

Sen. Marie Pinkney, the Senate prime sponsor, said lawmakers “must meet the moment” on consumer data rights. The release also said both bills were developed in partnership with the Delaware Department of Justice.

 

Why it matters

HB 381 changes how Delaware health care providers handle a breach. Until now, HIPAA-regulated entities benefited from certain exemptions under Delaware’s breach notification statute. The new law narrows those exemptions, so a HIPAA compliant response may no longer satisfy every Delaware obligation. Providers now carry a separate duty to decide whether state reporting applies.

Hospitals, physician groups, health systems, and business associates face growing cyber threats targeting protected health information (PHI), and identifying every affected patient can take weeks or months. Since HB 381 clarifies Attorney General notification when Delaware residents cannot be readily identified, providers may need to contact state regulators while their forensic investigations are still underway.

 

The bottom line

Delaware health care providers should not assume HIPAA compliance covers their state obligations. Review incident-response plans, make sure it addresses Attorney General notification, timing, and substitute notice, and document every investigative step and decision during an incident.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a forensic investigation after a data breach?

It is a technical review that determines how attackers got in, which systems were affected, and what data was exposed.

 

Why can it take weeks or months to identify affected patients?

Investigators often have to analyze large volumes of records across multiple systems to confirm whose information was exposed.

 

What does an Attorney General do when a breach is reported?

The Attorney General’s office oversees compliance with state consumer protection laws, so a breach report gives it visibility into incidents affecting state residents.

 

Why would a state law apply when an organization already follows HIPAA?

HIPAA sets a federal baseline, but states can add their own notification requirements that organizations must meet separately.