---
title: "Breach notice with a statute checklist"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-breach-notice-state-checklist"
type: "precedent"
site: "AI Law Framework"
id: "a25-us-breach-notice-state-checklist"
area_id: "A25"
kind: "letter"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R3", "A25-A20260923-4"]
law_stated_as_at: "2026-10-22"
---

# Breach notice with a statute checklist

> A notice letter with two filled statutes: HIPAA breach notification to individuals, and New York General Business Law § 899-aa. Every other jurisdiction is a blank the lawyer fills from a statute the lawyer has opened.

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-breach-notice-state-checklist  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Letter. A letter or email you adapt and send.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 6 authorities it cites, for United States.

## When to use it

Use when counsel has decided a notice may have to go out and needs the letter and the statute checklist in one place. Do not send it until the lawyer ticks the box that applies and deletes the rest. It is not a California notice.

## Used for these tasks

- [Assess a suspected data breach and draft the notification pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack.md)
- [Build a 48-hour incident chronology from the tickets and emails](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-48-hour-incident-chronology-from-the-tickets-and-emails.md)

## How AI may be used

AI may place facts the lawyer has already confirmed under the heading for the statute the lawyer ticks. The lawyer decides whether notice is required and which statute applies.

**AI may:**

- Copy dates, categories of information, and addresses from the incident log the lawyer marks
- Leave every unticked statute box out of the letter that will be sent
- Flag a day count that is not in the ticked statute

**AI must not:**

- Must not decide that notice is required
- Must not apply the New York period, or the HIPAA period, outside the statute that states it
- Must not send the letter or file a regulator notice

**The lawyer checks:**

- One path is ticked, and the facts match the incident log
- A business associate is not given the individual-notice letter as if it were the covered entity
- Any jurisdiction other than HIPAA and New York is either deleted or filled from a statute the lawyer opened

## Authorities

- [45 CFR § 164.404 (notice to individuals)](https://www.law.cornell.edu/cfr/text/45/164.404)
- [45 CFR § 164.408 (notice to the Secretary)](https://www.law.cornell.edu/cfr/text/45/164.408)
- [45 CFR § 164.410 (a business associate's notice to the covered entity)](https://www.law.cornell.edu/cfr/text/45/164.410)
- [N.Y. Gen. Bus. Law § 899-aa (notice to New York residents and to stated state agencies; text opened on the Senate site)](https://www.nysenate.gov/legislation/laws/GBS/899-AA)
- [FTC, Data Breach Response: A Guide for Business (suggested headings; the guide says state law controls what the notice must and must not say)](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business)
- [16 CFR § 314.4(j) (FTC notice by a financial institution covered by part 314, if a notification event involves at least 500 consumers)](https://www.law.cornell.edu/cfr/text/16/314.4)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-breach-notice-state-checklist and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*