Exam CIPP-US topic 1 question 106 discussion

Notice of Breach A breach applies only to “unsecured” information, and a covered entity can avoid liability if it utilizes encryption software to secure information (HIPAA Compliant). In the event of unauthorized acquisition, access, use or disclosure of information, a breach is presumed to have occurred, “unless the covered entity demonstrates through a risk assessment that there is a low probability that the security or privacy of the information has been compromised (HIPAA Compliant). If there is a high probability that the security or privacy of the information (financial, reputational or other) has been compromised, a covered entity must notify individuals within 60 days of discovery. If the breach affects more than 500 people, the covered entity must notify HHS immediately, and If the breach affects 500 or more in the “same jurisdiction”, it must notify the media. All breaches requiring notice must be reported to HHS at least annually.

Exception: Compliance with Other Laws. If notice of the breach of the security of the system is made pursuant to any of the following laws, nothing in this statute shall require separate notice to affected individuals, but notice must still be provided to the regulators noted above and the consumer reporting agencies. HIPAA

Most state statutes have carve-outs for entities subject to federal privacy laws. NY is no exception. A is the correct answer. https://www.perkinscoie.com/en/news-insights/security-breach-notification-chart-new-york.html