Dental Data Breach Notification in DC, Maryland and Virginia: Three State Laws and HIPAA, Side by Side
Monday morning in a Rockville dental office. The front desk clicked a link on Friday, the IT provider says files on one workstation were reached, and the patient list runs from Bethesda to Fairfax to Capitol Hill.
This is a plain-language summary of the statute text, not legal advice. The link the front desk clicked looked like an insurance remittance, and the office manager now has to work out who gets told, by whom and in what order.
This page is for the person who has to make the calls this week. It sets the three state texts and the federal rule side by side, in their own words, with a link to each official source. It then shows which records your IT provider usually holds that each statute line points to, a neutral first-week sequence, what to put in place before anything happens, and where the official offices are. It does not tell you what any law requires of your practice. That reading belongs to the lawyer you call.
Two terms come up throughout:
- Owner or licensee is the statutes' word for the business whose data it is. In a dental office that is usually the practice.
- Maintains data it does not own is how each statute describes an outside party that holds the practice's data, such as an IT provider, a hosted software vendor or a backup service.
In this guide
- Which laws can one DMV incident touch?
- Whose rule applies: the office's state or the patient's?
- What does the IT provider have to tell the practice, and when?
- What is the first-week sequence, and who owns each step?
- What should be in place before anything happens?
- Where do the official forms and contacts live?
- What to ask your IT provider about breach readiness
- Sources and how to read them
- Frequently asked questions
- The bottom line
Which laws can one DMV incident touch?
One incident at a DMV dental practice can touch four sets of rules: the District of Columbia's breach statute, Maryland's Personal Information Protection Act, Virginia's two breach sections (personal information and medical information), and the HIPAA Breach Notification Rule. Which ones apply turns on who the affected patients are and what data was reached, and counsel makes that call.
The table below is the core of this page. Each cell quotes the official text or says that the text does not address the point. Read across a row to see how the four sources word the same step. Read down a column to see one jurisdiction on its own. Nothing in the table is a summary of what the law requires of your office.
| Step | District of Columbia (D.C. Code §28-3851 et seq.) | Maryland (Com. Law §14-3501 et seq.) | Virginia (§18.2-186.6; §32.1-127.1:05 for medical information) | HIPAA (45 CFR 164.400–414) |
|---|---|---|---|---|
| Who is told: individuals | "promptly notify any District of Columbia resident whose personal information was included in the breach" (§28-3852(a)) | "the owner or licensee of the computerized data shall notify the individual of the breach", "unless the business reasonably determines that the breach of the security of the system does not create a likelihood that personal information has been or will be misused" (§14-3504(b)(2)) | "any affected resident of the Commonwealth" (§18.2-186.6(B)); "the subject of the medical information, and any affected resident of the Commonwealth" (§32.1-127.1:05(B)) | "notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach" (§164.404(a)(1)) |
| How fast individuals hear | "in the most expedient time possible and without unreasonable delay" (§28-3852(a)) | "as soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach of the security of a system" (§14-3504(b)(3)) | "without unreasonable delay" (both sections, (B)) | "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (§164.404(b)) |
| Regulators named (state AG and others) | Attorney General "if the breach affects 50 or more District residents"; "in no event later than when notice is provided under subsection (a)" (§28-3852(b-1)) | "Prior to giving the notification required under subsection (b) of this section and subject to subsection (d) of this section, a business shall provide notice of a breach of the security of a system to the Office of the Attorney General." (§14-3504(h)(1)) | "the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay" (§18.2-186.6(B)); medical information: "the Office of the Attorney General, the Commissioner of Health" (§32.1-127.1:05(B)) | HHS Secretary: for 500 or more individuals, "contemporaneously with the notice required by § 164.404(a)"; for fewer than 500, "not later than 60 days after the end of each calendar year" (§164.408(b), (c)) |
| Consumer reporting agencies | when required "to notify more than 1,000 persons" (§28-3852(c)) | "1,000 or more individuals" (§14-3506(a)) | "more than 1,000 persons at one time", to the Attorney General and the agencies (§18.2-186.6(E)); the medical-information section names the Attorney General and the Commissioner of Health, and its text does not name consumer reporting agencies (§32.1-127.1:05(E)) | The rule's text does not name consumer reporting agencies |
| Media | Only as part of substitute notice: "Notice to major local and, if applicable, national media" (§28-3851(2)(C)(ii)(III)) | Only as part of substitute notice: "Notification to major print or broadcast media in geographic areas where the individuals affected by the breach likely reside" (§14-3504(f)(3)) | Only as part of substitute notice: "Notice to major statewide media" (§18.2-186.6(A); same words in §32.1-127.1:05(A)) | "more than 500 residents of a State or jurisdiction": "notify prominent media outlets serving the State or jurisdiction" (§164.406(a)) |
| A holder of data it does not own, such as a vendor | tells the owner or licensee "in the most expedient time possible following discovery" (§28-3852(b)) | "as soon as reasonably practicable, but not later than 10 days after the business discovers or is notified of the breach" (§14-3504(c)(2)) | "without unreasonable delay following discovery of the breach of the security of the system" (§18.2-186.6(D); same words in §32.1-127.1:05(D)) | business associate to covered entity: "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (§164.410(b)) |
| Where the text speaks to HIPAA | "shall be deemed to be in compliance with this section with respect to the notification of residents", yet "shall, in all cases, provide written notice of the breach of the security of the system to the Office of the Attorney General" (§28-3852(g)) | "A business that is subject to and in compliance with the federal Health Insurance Portability and Accountability Act of 1996 shall be deemed to be in compliance with this subtitle." (§14-3507(d)(1)) | §18.2-186.6: the section text does not mention HIPAA. §32.1-127.1:05(F): "This section shall not apply to (i) a person or entity who is a 'covered entity' or 'business associate' under the Health Insurance Portability and Accountability Act of 1996 (42 USC § 1320d et seq.) and is subject to requirements for notification in the case of a breach of protected health information" | Not applicable: this column is the federal rule |
One plain sentence per statute, each with its official link:
- D.C. Code §28-3851 et seq. (Consumer Security Breach Notification): a business that owns or licenses DC residents' personal information notifies affected DC residents "in the most expedient time possible and without unreasonable delay", and tells the DC Attorney General when 50 or more District residents are affected, no later than it tells residents. Read §28-3852.
- Maryland Personal Information Protection Act, Com. Law §14-3501 et seq.: after a reasonable and prompt investigation, a business notifies affected Maryland residents within the 45-day limit in §14-3504(b)(3), and tells the Office of the Attorney General first. Read §14-3504.
- Virginia Code §18.2-186.6 (Breach of personal information notification): where an entity owns or licenses personal information about Virginia residents, it tells both the Office of the Attorney General and the residents affected, "without unreasonable delay". Read §18.2-186.6.
- Virginia Code §32.1-127.1:05 (Breach of medical information notification): the notice list here has three parts (the Attorney General, the Commissioner of Health and the people affected), and subsection (F) sets out who falls outside the section. Read §32.1-127.1:05.
- HIPAA Breach Notification Rule, 45 CFR Part 164 Subpart D: §164.404(b) caps a covered entity's notice to the people affected at 60 calendar days from discovery. Read Subpart D on eCFR.
Three details in these texts are easy to miss on a first read, so they are worth flagging to counsel.
DC's definitions name dentistry. §28-3851(1B) defines medical information as "any information about a consumer's dental, medical, or mental health treatment or diagnosis by a health-care professional." Read §28-3851.
DC sets an identity-theft offer when certain numbers are involved. Where a breach "includes or is reasonably believed to include a social security number or taxpayer identification number", §28-3852.02 has the business offer affected District residents identity theft protection services "at no cost to such District resident for a period of not less than 18 months." Read §28-3852.02.
Virginia splits the subject in two. The data elements in §18.2-186.6(A) are Social Security, driver's license or state ID, financial account, passport and military ID numbers. Medical information is defined in §32.1-127.1:05 instead, which is why the Virginia column carries both sections.
Whose rule applies: the office's state or the patient's?
Each of the three state statutes is written around the residence of the person whose information was involved, not around the location of the office. DC's text speaks of a "District of Columbia resident", Maryland's of "an individual residing in the State", and Virginia's of a "resident of the Commonwealth". Counsel decides how those words apply to a given incident.
Here are the words themselves, in context.
- DC, §28-3852(a): a business that "conducts business in the District of Columbia" and owns or licenses personal information "shall promptly notify any District of Columbia resident whose personal information was included in the breach."
- Maryland, §14-3504(b)(1): the investigation duty falls on "A business that owns, licenses, or maintains computerized data that includes personal information of an individual residing in the State".
- Virginia, §18.2-186.6(B): the trigger reads, in part, "identity theft or another fraud to any resident of the Commonwealth".
That is all this page will say about scope. Whether a given statute reaches a given practice, a given patient or a given kind of data is the kind of question the statutes leave to the people reading them with the facts in hand.
What the office can do, without interpreting anything, is make the question answerable. A DMV practice sits where three jurisdictions meet. A family might live in Silver Spring and see a dentist on Connecticut Avenue. A hygienist might commute from Alexandria to an office in Bethesda. Patients move from Arlington to Columbia and keep their dentist. The practice-management system knows where each patient lives as of the last update, and that address field is what counsel will ask about first.
So the practical step is a report, not a legal opinion. Ask whoever supports your Dentrix, Eaglesoft, Open Dental or other practice software to confirm that the office can export affected patients with their state of residence, filtered to the records that were reached. Run the export once now, on a quiet day, to see whether the address data is clean enough to count by state. Blank state fields, old addresses and guarantor-versus-patient addresses all make that count slower when it matters.
If the practice is part of a group with offices on both sides of the Potomac, the same question applies to each database. Where a group runs one shared database, an incident in a Maryland office can reach patient records entered in a Virginia office. Specialists who take referrals from all three jurisdictions face the same count; IT for specialty dental practices across the DC area covers their setup.
What does the IT provider have to tell the practice, and when?
Each statute gives a separate duty to whoever maintains data it does not own. DC says "in the most expedient time possible following discovery". Maryland sets "not later than 10 days" after discovery or notice. Virginia says "without unreasonable delay". HIPAA gives a business associate up to 60 calendar days. Counsel decides which applies to your provider.
The vendor lines, quoted in full where short:
- DC, §28-3852(b): an entity that "maintains, handles, or otherwise possesses" personal information it does not own "shall notify the owner or licensee of the information of any breach of the security of the system in the most expedient time possible following discovery." The text gives no fixed number of days.
- Maryland, §14-3504(c): the holder of the data tells the owner "as soon as practicable" (c)(1), and "not later than 10 days" after it learns of the breach (c)(2). In plain words, (c)(3) has the holder pass on what it knows about the breach, and (c)(4)(i) rules out a charge for the information the owner needs in order to send notices.
- Virginia, §18.2-186.6(D) and §32.1-127.1:05(D): the entity that maintains the data notifies the owner or licensee "without unreasonable delay following discovery of the breach of the security of the system".
- HIPAA, §164.410: "A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach", within the 60-day outer limit in (b).
The paper between the practice and its vendors comes into it too: Maryland §14-3503(b) and DC §28-3852.01(b) speak to service-provider contracts. Neither text spells out what the clause should say, so the practice's counsel drafts or reviews it.
The more useful question for an office manager is what the IT provider is holding that counsel will ask for. The table below is organised by statute line: each row starts from a quoted line, then names the record that line points toward, where it usually lives and who keeps it. Retention periods appear only where a statute states one.
| Statute line | Words in the text | Record your IT provider usually holds or can pull | Where it usually lives | Keeping it |
|---|---|---|---|---|
| Maryland §14-3504(b)(1) | "a reasonable and prompt investigation to determine the likelihood that personal information of the individual has been or will be misused" | Sign-in records, endpoint-protection alerts, firewall and remote-access logs covering the period in question | Microsoft 365 audit log, endpoint console, firewall, remote-access tool | Many systems overwrite older entries on a schedule; check each system's retention setting now, before you need it |
| Maryland §14-3504(b)(4) | "maintain records that reflect its determination for 3 years after the determination is made" | The investigation summary, the logs it relied on and the dated ticket trail behind a decision not to notify | Provider's ticketing system; exports saved to the practice's own storage | The statute states 3 years after the determination; keep a copy the practice controls |
| Maryland §14-3504(c)(2)–(3) | "not later than 10 days"; (c)(3) has the holder share what it knows about the breach | The dated notice the provider sent the practice, and whatever detail came with it | Email, ticket, incident report | Kept with the incident file; the date it arrived is the fact counsel asks for |
| DC §28-3852(b-1) | the written notice to the Attorney General lists eleven items, including "(5) The number of District residents affected by the breach" and "(11) A sample of the notice to be provided to District residents" | An export of affected patient records with state of residence, so DC residents can be counted | Practice-management database (Dentrix, Eaglesoft, Open Dental and others) | Saved as run, with the date and filter used |
| Maryland §14-3504(h)(2) | "(ii) A description of the breach of the security of a system, including when and how it occurred" | A timeline: first alert, accounts used, devices reached, containment steps, each with a timestamp | Endpoint console, Microsoft 365 audit log, provider's ticket notes | Kept with the incident file |
| DC §28-3852.02 | "a social security number or taxpayer identification number" | A map of which systems store those numbers: patient or subscriber records, scanned insurance cards, payroll files | Practice software fields, document scanning folders, payroll and HR systems | Keep the map current; re-check after any software change |
| Virginia §18.2-186.6(B) | "unencrypted or unredacted personal information" | A device-encryption status report for laptops, workstations and servers holding patient data | Device-management or encryption console | Run on a schedule and save the dated result |
| Maryland §14-3503(b); DC §28-3852.01(b) | Both sections speak to security terms in contracts with service providers (cited by number here) | The signed service agreement and any business associate agreement | Practice's contract files | For as long as the agreement runs, and per counsel after |
| HIPAA §164.408(c) | "maintain a log or other documentation of such breaches" involving fewer than 500 individuals | The incident record the practice keeps for its yearly HHS submission | Practice's compliance files, with supporting exports from the provider | Per counsel; the rule sets the yearly submission timing |
| HIPAA §164.410 | "notify the covered entity of such breach" | The business associate's dated notice | Email, ticket | Kept with the incident file |
Two gaps are worth checking for first. Log retention can be shorter than anyone assumed, because a default setting was never changed. And the practice may hold no copy of its own: if the records live only in the provider's systems, the practice is relying on getting them back. Both are fixable on a quiet day and hard to fix during a bad week.
Legend's page on dental cybersecurity services sets out the provider side. For what a written agreement with a Maryland provider can say about security, see what a Maryland managed IT agreement should say about security.
What is the first-week sequence, and who owns each step?
The first week after a suspected breach runs in roughly six workstreams: contain the problem, preserve the evidence, bring in counsel and the cyber insurer, work out whose records were reached, prepare notices, and file with regulators in the order each statute states. The practice owns the decisions; IT, counsel and the insurer each own specific steps.
This is a working checklist, not a legal sequence. The only ordering it states as fixed is ordering the statute text itself fixes, and those lines are quoted.
Day 0–1: contain and preserve (IT provider, with the office manager)
- [ ] Isolate the affected workstation from the network. Leave it powered on unless the IT provider or the insurer's responders say otherwise, because memory and running processes can matter to the investigation.
- [ ] Reset the passwords of any account used on that machine, starting with email and the practice-management login, and check that multi-factor authentication is on for each.
- [ ] Ask the IT provider to export and save the logs now: Microsoft 365 sign-ins and mailbox audit, endpoint alerts, firewall and remote-access logs. Logs that roll over can disappear while people are still deciding what happened.
- [ ] Start one written timeline with the time of each event and who did what. One document, one owner.
Day 1: call counsel and the insurer (practice owner)
- [ ] Call the practice's counsel. If the cyber policy names a breach coach or panel firm, it says how and when to report.
- [ ] Call the cyber insurer on the number in the policy. Ask what it needs from the IT provider and whether it appoints forensic responders.
- [ ] Agree who speaks to staff, and what they say to a patient who calls. Keep it short and factual until counsel has advised.
Days 2–5: scope (IT provider and office manager, for counsel)
- [ ] Identify which data was reached: practice-software records, imaging, scanned documents, email attachments, payroll files.
- [ ] Export the affected patients with state of residence (see the section on whose rule applies above).
- [ ] Note which data types appear: Social Security or taxpayer numbers, insurance identifiers, driver's license numbers, financial account numbers, treatment information. Each statute lists its own data elements.
- [ ] Confirm whether the data was encrypted at rest and who held the keys.
Days 3–7 and on: notices and filings (counsel leads; the practice approves)
- [ ] Counsel decides which statutes and the federal rule apply, and whether a Maryland no-notice determination applies. If it does, §14-3504(b)(4) has the business "maintain records that reflect its determination for 3 years after the determination is made."
- [ ] Order of filings: where Maryland applies, §14-3504(h)(1) reads "Prior to giving the notification required under subsection (b) of this section ... a business shall provide notice of a breach of the security of a system to the Office of the Attorney General." Where DC applies, §28-3852(b-1) has the Attorney General notice made "in no event later than when notice is provided under subsection (a)".
- [ ] DC §28-3852(b-2): the AG notice "shall not be delayed on the grounds that the total number of District residents affected by the breach has not yet been ascertained."
- [ ] Draft patient notices. DC §28-3852(a-1) lists contents, including contact details for the Federal Trade Commission and the DC Attorney General.
- [ ] Consumer reporting agencies and HHS, at the thresholds and timing in the table above.
Each statute also has a delay provision, worded differently. DC §28-3852(d) allows delay "if a law enforcement agency determines that the notification will impede a criminal investigation". Maryland §14-3504(d)(1) adds delay "To determine the scope of the breach of the security of a system, identify the individuals affected, or restore the integrity of the system." Virginia §18.2-186.6(B) says notice "may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system." Counsel reads these against the facts.
What should be in place before anything happens?
Before any incident, a DMV practice is better placed with five things ready: multi-factor authentication on email and remote access, logs kept long enough to investigate, backups that have been test-restored, an encryption report for devices holding patient data, and a printed contact sheet naming counsel, the cyber insurer and the IT provider.
Two statutes in the region also have a general security section, which is worth reading alongside the notice rules.
- Maryland §14-3503(a): any business owning, licensing or maintaining personal information about Maryland residents "shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information owned, maintained, or licensed and the nature and size of the business and its operations." Read §14-3503.
- DC §28-3852.01(a): where a business holds personal information about someone who lives in the District, it "shall implement and maintain reasonable security safeguards, including procedures and practices that are appropriate to the nature of the personal information and the nature and size of the entity or operation." Read §28-3852.01.
Neither text lists specific controls. The list below is a readiness list, not a reading of either section.
| Readiness item | Why it matters on a bad day | Who usually owns it |
|---|---|---|
| Multi-factor authentication on Microsoft 365, remote access and the practice-software admin account | A stolen password alone does not open the account | IT provider sets it up; office manager confirms each person enrolled |
| Log retention checked on email, endpoint, firewall and remote-access tools | The investigation can only see as far back as the logs go | IT provider |
| A dated restore test of the practice-management and imaging data | Shows the data can be brought back, and how long that takes | IT provider runs it; practice keeps the result |
| Device-encryption report | Answers the "unencrypted or unredacted" question in minutes | IT provider |
| Patient export with state of residence, tested | Makes the residence count fast and accurate | Office manager with the practice-software vendor or IT provider |
| Map of where Social Security and taxpayer numbers are stored | Speeds up the data-type question | Office manager and IT provider |
| Signed service agreements and business associate agreements on file | Counsel will ask for them on day one | Practice owner |
| Printed contact sheet: counsel, insurer claim line, IT provider, practice-software vendor | Email may be the system that is down | Office manager |
For backups, see backup and recovery for dental practices. For a wider readiness review, the HIPAA checklist for dental practices walks through safeguards, and HIPAA readiness support is Legend's page for that service. The dental cybersecurity guide covers the threats themselves.
Where Legend fits: Legend Networking has 22+ years in dental IT (since 2004) and has served over 3,500 practices since 2004. It is headquartered in Dallas and provides 24/7 monitoring, with a staffed 24/7 helpdesk at 1-800-794-1588. Support model: in-house engineers; no outsourced first-level triage. Ian Lynch has 22 years in dental IT and oversees the NOC, onsite dispatch and client technology roadmaps. On Google: 4.8 rating · 173 Google reviews. Practices on the District side can start at our Washington, DC support page, those further north at dental IT support around Baltimore, and our DC, Maryland and Virginia dental IT guide takes in the IT picture for the whole region.
Where do the official forms and contacts live?
The official offices named in these statutes are the DC Office of the Attorney General, Maryland's Office of the Attorney General, Virginia's Office of the Attorney General and Commissioner of Health, and the U.S. Department of Health and Human Services. Each has its own submission channel. Counsel usually makes the filings, but the practice should know where they go.
| Office | Named in | Official page | Note |
|---|---|---|---|
| Office of the Attorney General for the District of Columbia | §28-3852(b-1), (a-1)(4)(B) | Requirements of the District's Data Breach Notification Law | The page says: "To report a breach to OAG, please email databreach@dc.gov." (read 2026-10-19) |
| Maryland Office of the Attorney General | §14-3504(h)(1); contents in (h)(2) | Statute text, §14-3504 | Counsel confirms the Office's current submission channel |
| Office of the Attorney General of Virginia | §18.2-186.6(B), (E); §32.1-127.1:05(B), (E) | Database Breach Notification Requirements (PDF) | A PDF posted by the Office; check its date on the document before relying on contact details |
| Virginia Commissioner of Health | §32.1-127.1:05(B), (E) | Statute text, §32.1-127.1:05 | Read subsection (F) with counsel first |
| Secretary of Health and Human Services | 45 CFR §164.408 | Subpart D on eCFR | The rule says notice goes "in the manner specified on the HHS Web site" |
| Nationwide consumer reporting agencies | DC §28-3852(c); MD §14-3506(a); VA §18.2-186.6(E) | Statute text (links above) | Thresholds differ: "more than 1,000" in DC and Virginia, "1,000 or more" in Maryland |
| Federal Trade Commission | DC §28-3852(a-1)(4)(A) | Statute text, §28-3852 | Named as a contact to include in DC resident notices |
Print this table with the contact sheet. On the day, the person filling in a form is rarely the person who read the statute.
What to ask your IT provider about breach readiness
These questions are written so the answer is a document or a date, not a reassurance. Several point to a specific statute line above.
- Should you find a breach on any system holding our records, who on your side contacts which person on ours, by what route, and does our signed agreement say so? (DC §28-3852(b); Maryland §14-3504(c); Virginia §18.2-186.6(D); HIPAA §164.410)
- How long do our Microsoft 365, endpoint, firewall and remote-access logs go back today, and can you show us the settings?
- Can you export, this month, a list of our patients with state of residence from our practice software, and tell us how clean the address data is?
- Which of our systems store Social Security or taxpayer identification numbers, including scanned insurance cards and payroll files? (DC §28-3852.02)
- Which laptops, workstations and servers holding patient data are encrypted, and can you send us a dated report? (Virginia §18.2-186.6(B) uses the words "unencrypted or unredacted")
- When did you last test-restore our practice-management and imaging data, and where is the result?
- If our counsel asks for a timeline of an incident, which timestamps can you produce, and from which systems?
- Do we hold our own copy of incident records, or do they live only in your ticketing system?
- Does our signed agreement include the security terms our counsel wants under Maryland §14-3503(b) or DC §28-3852.01(b), and do we have a business associate agreement on file?
- Who else do you subcontract to that can reach our data, and how would they tell you, and you tell us?
- If our cyber insurer appoints its own responders, how will you work with them and hand over logs?
- Is multi-factor authentication on for every account that can reach patient data, including vendor and admin accounts? Can you send the list?
Sources and how to read them
We read each statute line quoted here on 2026-10-19, at the official source for each jurisdiction. DC: the Council's code site (§§28-3851, 28-3852, 28-3852.01, 28-3852.02). Maryland: the General Assembly's statute-text pages (Commercial Law §§14-3503, 14-3504, 14-3506, 14-3507). Virginia: the Legislative Information System (§18.2-186.6 and §32.1-127.1:05). Federal: the eCFR (45 CFR Part 164 Subpart D). Statutes are amended; read the current text at the link before relying on any line here. The Virginia code pages note that their history lists "may not constitute a comprehensive list" of amending acts. Penalty provisions exist in these statutes; this page does not summarise them.
This is a summary of the statute text, not legal advice, and counsel decides what applies to your practice.
Frequently asked questions
Our office is in Maryland. Do DC or Virginia rules matter if some patients live there?
Each state statute is written around the affected person's residence: DC's text says "District of Columbia resident", Maryland's "an individual residing in the State", Virginia's "resident of the Commonwealth". Whether any of them reaches your practice is a question for counsel. What helps is a patient export by state of residence, so the question can be answered quickly. This is a plain-language summary of the statute text, not legal advice.
How soon does Maryland's text say a vendor holding our data tells us about a breach?
Under Maryland Commercial Law §14-3504(c)(2), the outside holder of a practice's data gives the owner notice "as soon as reasonably practicable, but not later than 10 days after the business discovers or is notified of the breach". In plain words, (c)(3) also has the holder pass on what it knows, and (c)(4)(i) rules out billing the practice for what it needs to send notices.
Does DC's breach law mention dental records specifically?
Yes, in its definitions. D.C. Code §28-3851(1B) defines medical information as "any information about a consumer's dental, medical, or mental health treatment or diagnosis by a health-care professional." How that definition interacts with the rest of the statute in a particular incident is a question to put to counsel, along with which data fields in your practice software hold that kind of information.
What does the DC statute say about HIPAA-covered practices and the Attorney General?
D.C. Code §28-3852(g) says an entity that follows the HHS breach rules and notifies residents accordingly is deemed in compliance "with respect to the notification of residents". The same subsection adds that the entity "shall, in all cases, provide written notice of the breach of the security of the system to the Office of the Attorney General". Counsel reads both sentences against the facts.
Does Virginia's medical-information breach section cover dental practices that follow HIPAA?
A HIPAA "covered entity" or "business associate" subject to federal breach-notification requirements falls under subsection (F) of Virginia Code §32.1-127.1:05, which says the section "shall not apply to" it. Virginia's other breach section, §18.2-186.6 on personal information, has no line about HIPAA. Counsel decides which of the two reaches a given practice and data set.
At what point do consumer reporting agencies come into it?
The thresholds are worded differently. DC §28-3852(c) uses "more than 1,000 persons", Maryland §14-3506(a) uses "1,000 or more individuals", and Virginia §18.2-186.6(E) uses "more than 1,000 persons at one time", adding the Attorney General. Virginia's medical-information section names the Attorney General and Commissioner of Health at that threshold, not the agencies.
Can the notice to the DC Attorney General wait until we know the exact number of affected residents?
D.C. Code §28-3852(b-2) says the Attorney General notice "shall not be delayed on the grounds that the total number of District residents affected by the breach has not yet been ascertained." The same section sets the 50-resident threshold for that notice. Counsel decides when the threshold is met, which is easier with a clean patient export by state.
Do DC and Virginia give our IT vendor a set number of days to tell us about a breach?
Neither state text gives a number. DC §28-3852(b) has the data holder tell the owner "in the most expedient time possible following discovery", and Virginia §18.2-186.6(D) says "without unreasonable delay following discovery of the breach of the security of the system". Maryland's 10 days is the only state count, and HIPAA gives a business associate 60 calendar days at most (§164.410(b)). Counsel reads these against the facts.
Is there a single deadline that covers all three states and HIPAA?
No single deadline appears in the texts. Maryland states a 45-day outer limit for individuals, HIPAA states 60 calendar days after discovery, and DC and Virginia use words such as "without unreasonable delay" with no number. Maryland also puts its Attorney General notice "Prior to" individual notice. Counsel sets the working timeline for each incident.
The bottom line
If the evidence table on this page left blanks, such as logs nobody has checked or an export nobody has run, that is the place to start. That is what Legend's Free Dental IT Assessment is for, and you are welcome to ask for one: it reviews your computers, software, network security, backups and performance and comes back with written findings and prioritized recommendations. Bring the evidence table with your answers pencilled in; the gaps are the useful part.