What a Vendor Owes the Organization That Hired It

Most personal information sits somewhere other than the organization that collected it. Payroll processors, claims administrators, hosting providers and analytics platforms hold copies of records they do not own, and the statutes treat them as a distinct category with a distinct duty. That duty runs upward to the owner of the data rather than outward to the people described in it, and it is the hinge on which the whole notification schedule turns.

The duty runs to the owner, not to individuals

California requires an entity that maintains computerized data including personal information it does not own to notify the owner or licensee of the breach immediately following discovery, where the information was or is reasonably believed to have been acquired by an unauthorized person. Washington imposes the same duty in the same terms on a person or business that maintains or possesses data it does not own or license. Vermont applies the obligation to a data collector holding personally identifiable information or login credentials it does not own or license.

Ohio words the standard differently, requiring a custodian of stored data acting on behalf of or at the direction of another person or a governmental entity to notify that person in an expeditious manner. Delaware combines the notice with an affirmative cooperation duty: the vendor must give notice to and cooperate with the owner or licensee immediately following determination, and cooperation is defined to include sharing information relevant to the breach. That definition matters, because the failure mode in vendor incidents is rarely silence; it is a notice with nothing usable in it.

Two features of this upward duty are easy to overlook. It is owed even where the vendor concludes that the owner will not have to notify anyone, because the vendor is not the party entitled to make that call. And it attaches to the vendor's own discovery rather than to the owner's, so the vendor's internal detection date becomes the fact on which the owner's later defense of its schedule depends. An owner that cannot establish when its processor knew cannot establish when its own obligations began.

Sixty days at both levels, running at once

The federal health rule takes a different approach and creates the field's sharpest timing problem. A business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than sixty calendar days after discovery, with discovery defined the same way it is for a covered entity: knowledge attributed to any employee, officer or other agent other than the person who committed the breach.

The covered entity's own sixty days, described in the sixty-day rule for health information, runs from its own discovery. If the business associate is not an agent of the covered entity, the covered entity ordinarily discovers the breach when it is told. A business associate that uses its full period therefore hands over an incident on the day the covered entity's clock begins, having already consumed two months of elapsed time, and the covered entity must then investigate, decide and write to individuals inside its own sixty days.

What the upward report has to carry

The federal rule sets the fullest content requirement. The business associate must include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed to have been, accessed, acquired, used or disclosed during the breach. It must also provide any other information the covered entity is required to include in its notice to individuals, either at the time of the report or promptly afterwards as information becomes available.

The state statutes say less about content and more about cooperation, but the practical requirement converges. An owner cannot run the analysis described in the definitional test for a breach without knowing which records were touched, whether they were encrypted, and whether any key or credential was taken. A vendor report that describes an intrusion without identifying the affected data set leaves the owner unable to start, and the owner's clock is running regardless.

Delaware's cooperation duty is the most useful state formulation for that reason. By defining cooperation to include sharing information relevant to the breach, it converts a reporting obligation into a continuing one, which is closer to what an owner actually needs. Most states say nothing equivalent, and in those jurisdictions the owner's only leverage after the first report is whatever the agreement provides. That is the main reason the contractual terms below are treated as the operative rules rather than as a supplement to them.

Where the contract does the work

The statutory floors are too loose to run an incident on, so the operative terms are usually contractual. Common provisions compress the vendor's report to a short fixed period measured in hours or days, define discovery to include specified detection events rather than leaving it to the vendor's judgment, require preservation of forensic material, allocate the cost of notification, and prohibit the vendor from communicating with affected individuals or with regulators without the owner's approval. Florida's statute anticipates the last point in the other direction, permitting an agent to give notice on the covered entity's behalf while leaving the obligation with the covered entity if the agent does not.

Two further clauses earn their place. The first requires the vendor to supply, in its first report, the categories of information involved and the count of affected records by jurisdiction, because those are the inputs to the threshold work described in notice to a state regulator and its thresholds. The second requires the vendor to identify its own subcontractors holding the same data, since the chain frequently runs further down than the owner's register shows, and each link has its own statutory duty to the link above it.