One Missing Tape, Two Legal Regimes, 130 Controllers

Rule. GDPR Art. 33 requires a controller to notify the lead supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk; Art. 33(2) requires a processor to notify the controller without undue delay. Art. 34 requires notice to data subjects without undue delay where there is a high risk. HIPAA requires a covered entity to notify individuals within 60 days of discovery (45 CFR 164.404), and a business associate to notify the covered entity without unreasonable delay and no later than 60 days after discovery (164.410). State statutes run from roughly 30 days in some states to 'without unreasonable delay' in others.

Application. MedAxis occupies three positions. For the US patient records it is a business associate: it notifies the 130 covered entities, which then notify individuals, HHS and - where 500 or more residents of a state are affected - the media in that state. For the Berlin customer accounts it is a processor: it notifies each EU controller, which notifies the supervisory authority. For its own German HR files it is the controller: it owes the Berlin supervisory authority notice within 72 hours and, given the sensitivity, direct notice to employees.

Conclusion. The 72-hour GDPR clock is the earliest deadline and the DPO is right that it runs from awareness, not from confirmation of the drive's whereabouts. The internal 30-day standard is too slow for the earliest state statutes and should be rewritten to the shortest applicable deadline, with a per-jurisdiction matrix rather than a single policy line.

Rule. HIPAA presumes a breach following an impermissible acquisition, access, use or disclosure, rebuttable only by demonstrating a low probability of compromise through a documented four-factor assessment (45 CFR 164.402): the nature and extent of the PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and the extent of mitigation. Encryption to a specified standard creates a safe harbor; an unencrypted tape gets no benefit from that provision. GDPR has no equivalent presumption and no 'harm' safe harbor - the test is the risk to the rights and freedoms of natural persons, and the assessment must be documented (Art. 33(5)). State statutes split: some require notice on acquisition regardless of harm, others use a risk-of-harm trigger.

Application. The tape was unencrypted and has been out of MedAxis's control since 12 September - nearly four weeks before the report. It passed through an auction, so MedAxis cannot establish who held it or that no one viewed it. The four-factor assessment fails on factors two, three and four; the HIPAA presumption stands. Under GDPR the diagnosis codes and insurance identifiers, plus HR files that may contain disciplinary or health information, support a finding of high risk for the EU population, triggering Art. 34 notice to those individuals and not merely to the authority.

Conclusion. 'The drive was never accessed' is an assertion, not a finding, and it cannot be documented. Run separate, written assessments for the US and EU populations rather than one global harm test, and retain the reasoning - the assessment is itself the deliverable regulators will ask for.

Rule. Under HIPAA the notification duty sits with the covered entity; the business associate's obligation runs to the covered entity (164.410), and the business associate agreement typically allocates who drafts and who sends. Substitute notice - website posting - is permitted only in narrow circumstances, such as insufficient or out-of-date contact information for ten or more individuals, and must be combined with a toll-free number and other measures. Under GDPR the controller notifies the supervisory authority and the data subjects; a processor that notifies data subjects directly without the controller's instruction is acting outside its role.

Application. A single mass mailing from MedAxis would not discharge 130 hospitals' individual obligations unless each business associate agreement delegates the function and each covered entity approves the content. Several clients will insist on their own letter, branding and call center because their patient relationships and their own state AG exposure are at stake. Website posting alone would be inadequate for both regimes here - the contact information for patients and employees is presumably available.

Practical route. Notify all 130 covered entities simultaneously with a template, a call center and a shared FAQ, and let each decide whether to send or delegate. For the German records, determine entity by entity whether MedAxis Berlin is controller or processor: for its own HR files it must notify employees directly and the Berlin authority within 72 hours; for customer data it must notify the controllers and assist them. Keep the two duties separate in the breach log - conflating them is the most common error in multi-regime breaches.