Documenting a Decision Not to Notify

Most incidents end without letters. The population turns out to be encrypted, the data falls outside the statutory categories, or the assessment concludes that harm is unlikely. Each of those outcomes is lawful, and each of them is a position the organization will have to defend if the incident later becomes visible. The statutes anticipate this by converting the conclusion into a document with a required content, a keeper and a retention period.

The burden sits with the organization

The federal health rule states the allocation without qualification. In the event of a use or disclosure in violation of the privacy subpart, the covered entity or business associate has the burden of demonstrating that all notifications were made as required, or that the use or disclosure did not constitute a breach as defined. Nothing in the rule requires a regulator to show that notice was owed; the entity has to show that it was not.

That allocation is reinforced by the documentation standard the breach subpart imports. A covered entity must maintain a written or electronic record of any action, activity or designation the subpart requires to be documented, and must maintain documentation sufficient to meet its burden of proof. The retention period is six years from the date of creation or the date when the document last was in effect, whichever is later, which is considerably longer than the operational memory of most incident response teams.

What the assessment has to work through

Under the federal rule the content is prescribed by the definition itself. An impermissible acquisition, access, use or disclosure is presumed to be a breach unless the entity demonstrates a low probability that the information has been compromised, based on a risk assessment of at least four factors: the nature and extent of the information involved, including the types of identifiers and the likelihood of re-identification; the unauthorized person who used the information or to whom the disclosure was made; whether the information was actually acquired or viewed; and the extent to which the risk has been mitigated.

Each factor should appear as its own finding. A document that recites the four and then states a conclusion has not demonstrated anything, because the demonstration is the reasoning under each head. The third factor is the one that most often defeats a favorable conclusion: an entity that cannot establish what an intruder reached is not in a position to say the information was not viewed, and the absence of evidence is not evidence of absence. Where the exclusions apply instead, the file should identify which one and record the condition attached to it, since every exclusion depends on the information going no further.

The state standards are looser in wording and no looser in practice. Florida asks whether the breach has not and will not likely result in identity theft or other financial harm; New York asks whether an inadvertent disclosure will not likely result in misuse or in financial or emotional harm. Both are predictions, and a prediction recorded without its basis is an opinion. The useful form states what categories of data were involved, who held them afterwards, what could be done with them, and why that is unlikely to translate into the harm the statute names.

The states that ask to see it

Two statutes turn the internal record into an external filing. New York permits an entity to decline notice where the exposure was an inadvertent disclosure by persons authorized to access the information and the entity reasonably determines it will not likely result in misuse or in financial or emotional harm; the determination must be documented in writing and maintained for at least five years, and where the incident affects more than five hundred New York residents the written determination goes to the attorney general within ten days.

Florida permits notice to be withheld where, after an appropriate investigation and consultation with relevant law enforcement agencies, the covered entity reasonably determines that the breach has not and will not likely result in identity theft or other financial harm. That determination must be documented in writing, maintained for at least five years, and provided to the department within thirty days after it is made. Delaware does not require a filing but conditions its exemption on an appropriate investigation having preceded the determination, which is the same requirement expressed as a precondition rather than a deliverable.

The two filing provisions repay close reading because they are not symmetrical. New York's runs from the determination and is measured in days, so an entity that reaches its conclusion early and files late has missed a deadline that nothing in the consumer timetable would have flagged. Florida's is longer but attaches to an exemption that already requires consultation with law enforcement, so the file has to show who was consulted and what they said before the determination was reached. Neither statute treats the filing as optional once the resident count is crossed.

What belongs in the file, and when

A usable record has six parts. The forensic findings relied on, identified by source and date of receipt. The encryption state of each affected data set and the evidence for it, which is where the reasoning described in the encryption safe harbor and its conditions is written down. The categories of information involved, tested against each applicable statutory definition rather than against a generic notion of sensitive data. The count of affected residents by state, since the counts drive both filings and thresholds. Any communication with law enforcement, including the identity of the official and the terms of any request. And the conclusion, with the reasoning under whichever standard governs.

Where the data was held by an outside processor, the file is incomplete without what that processor supplied and when, because the organization's own timing depends on it. The reporting duties that produce those inputs are set out in what a vendor owes the organization that hired it. And because the whole exercise depends on which definition is being applied, the file should say which one, a point developed in what counts as a breach.