Incident response legal playbook: meeting CIRCIA, HIPAA, and state notification deadlines

You discover a breach at 9 PM on a Friday. By the time legal is on the call, three separate clocks are already running: a federal CIRCIA window, a HIPAA deadline, and a stack of state notification laws each with its own timer. Miss any one and you are answering to regulators, not just cleaning up the incident. This playbook maps the overlap and tells you exactly what to do first.

The multi-clock problem every security team faces

Most teams build incident response plans for one regulator at a time. That is not how real breaches work.

A healthcare SaaS company that suffers a ransomware attack exfiltrating protected health information is simultaneously subject to three regulatory regimes:

CIRCIA's mandatory reporting to CISA, if the company qualifies as covered critical infrastructure
HIPAA's Breach Notification Rule, with its 60-day individual notification requirement
The breach notification laws of every state where affected individuals reside

Each law has a different definition of "incident." Each has a different scope. Each runs a different clock. A runbook built for HIPAA will not catch the CIRCIA window. A state law checklist skips the federal filing entirely.

The operational fix is a single incident record that maps each event against every applicable obligation the moment you declare an incident — before anyone starts deep investigation.

CIRCIA: understanding the federal reporting window

The Cyber Incident Reporting for Critical Infrastructure Act established a framework for mandatory cyber incident reporting to CISA. The proposed rule calls for covered entities to report substantial cyber incidents within 72 hours of reasonable belief that one has occurred [source: https://www.vaasblock.com/news/circia-final-rule-cyber-incident-reporting-cisa-2026/]. Ransomware payment reports carry a tighter deadline: 24 hours [source: https://www.alation.com/blog/circia-compliance-guide-2026/] from the time the payment is made.

Three things trip teams up.

"Reasonable belief" starts the clock, not confirmed impact. You do not need to complete your investigation before filing. Report what you know at the time and submit supplemental reports as your understanding develops. Scope is larger than most teams expect. Sixteen critical infrastructure sectors are covered [source: https://www.fisherphillips.com/en/insights/insights/new-federal-cybersecurity-reporting-rules-are-on-their-way], including healthcare, financial services, energy, and information technology. Technology vendors that process data for entities in these sectors should verify whether they qualify as covered entities before an incident forces the question. CIRCIA reports go to CISA, not HHS. This is a completely separate filing from your HIPAA notification. Both obligations can run in parallel on the same incident, with different owners and different recipients.

"Substantial cyber incident" is defined broadly in the proposed rule [source: https://www.alation.com/blog/circia-compliance-guide-2026/]. Unauthorized access resulting in significant impact on availability, integrity, or confidentiality qualifies. So does a ransomware attack even before you have confirmed data exfiltration. When in doubt, report and supplement — CISA has stated that good-faith early reports will not be penalized for incomplete information.

HIPAA breach notification: the 60-day rule in practice

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach [source: https://www.decryptiondigest.com/blog/data-breach-response-notification-guide]. The HHS reporting deadline runs on the same 60-day clock. If the breach affects more than 500 residents of a single state or jurisdiction, the covered entity must also notify prominent media outlets in that state within the same window [source: https://www.decryptiondigest.com/blog/data-breach-response-notification-guide].

Business associates carry their own obligation. When a BA discovers a breach involving covered entity data, they must notify the covered entity within 60 days. The covered entity's clock starts from when the BA notifies them — or when they should have notified them. A BA that delays can silently accelerate the covered entity's deadline without the covered entity knowing it is happening.

What "discovery" means is critical. HIPAA treats discovery as the first day an entity knew — or, through reasonable diligence, should have known — that a breach occurred. A slow investigation does not pause the clock.

The small-breach exception is a common operational trap. Breaches affecting fewer than 500 individuals in a calendar year may be reported to HHS on an annual basis rather than within 60 days. Individual notification, however, still must happen within 60 days of discovery. Teams that correctly identify a small breach sometimes mistakenly apply the HHS reporting flexibility to the individual notification requirement and miss that deadline entirely.

State notification laws: the hardest layer to operationalize

All 50 US states, plus the District of Columbia and several US territories, have enacted breach notification laws [source: https://www.decryptiondigest.com/blog/data-breach-response-notification-guide]. For a SaaS business with a national customer base, a single incident can simultaneously trigger notification obligations in dozens of jurisdictions, each with different requirements.

They diverge on four dimensions that matter operationally:

Trigger definition. Some states require notification only when harm is likely or has occurred. Others require notification for any unauthorized access to defined categories of personal information, regardless of whether harm can be demonstrated.
Timeline. Many states set windows in the 30 to 45-day range. Several require faster action for specific data categories — financial account data and health-related data are common triggers for expedited timelines.
Covered data categories. Most states include the traditional name-plus-SSN or name-plus-financial-account combination. A growing number also cover biometric identifiers, precise geolocation, and health data that sits outside HIPAA's scope.
Regulatory filing. Multiple states require separate notification to the state attorney general, sometimes on a tighter timeline than the consumer notice itself.

For a company with customers across the country, this is not something you can solve during the incident. The analysis needs to exist before the breach.

Building a state law matrix before you need it

Maintain a working record of which states your customer base represents, each state's trigger threshold, the notification timeline, required notice content, and any attorney general filing obligation. Assign ownership to a specific attorney or legal operations team. Review it at least twice per year — state breach notification laws were among the most actively amended privacy statutes in the 2024–2026 period, and the content requirements in particular shift without much industry attention.

Building a runbook that handles all three regimes

The operational answer to multi-regulator complexity is a single incident record with mandatory fields at intake.

Capture the discovery timestamp immediately. All three regulatory clocks run from this moment. Log it in writing at the time of declaration, not reconstructed afterward during a post-incident review. Map obligations at intake, not after investigation. The runbook asks at incident open: Does this involve PHI or other protected personal information? Does it meet CIRCIA's substantial incident threshold? Which states have customers potentially affected? Each yes answer adds a deadline to the record and assigns an owner before the investigation branches. Assign separate filing owners in advance. CIRCIA reports to CISA are typically owned by the security team. HIPAA notifications run through privacy counsel. State notifications usually go through outside breach counsel with coordination from legal operations. These ownership assignments need to be made before an incident, not negotiated under a 72-hour federal window. Keep pre-approved notice templates current. A template cleared by counsel for HIPAA incidents and a library of state-specific notice variations saves hours when you are simultaneously managing a live threat and a filing deadline. Track completion, not just deadlines. A deadline column with no evidence of completion is an audit finding waiting to happen. Capture the confirmation of each filing — timestamp, method, and recipient — in the incident record at the time it is submitted.

The friction is not writing the notices themselves. It is keeping the runbook synchronized with regulatory changes and your current customer footprint as the business grows.