Answer: D - Notification of a breach occurring from a HIPPA-cover entity does not commonly require notification to the Attorney General in many states. Under Illinois HB 1260, the Attorney General must be notified.
This state law requires notifications of breaches occurring from HIPAA-covered entities to be provided to the Attorney General in addition to standard notification to the Office for Civil Rights and HHS. The Attorney General must be notified of the breach within five days of notification to the Office for Civil Rights. In addition, HIPAA breach notification regulations mandate notification to the Office for Civil Rights.
