Iowa has joined the growing number of state governments to tighten up data security laws by proposing an update to its breach notification act, which includes a requirement for organizations to report data breaches within 45 days.

Although Iowa previously required organizations to report breaches “without reasonable delay,” the proposal specifies the timeline. The timeframe is about two weeks shorter than HIPAA breach reporting requirements, which is within 60 days.

[Also: North Carolina proposes law requiring data breaches to be reported in 15 days]

Proposed in a judiciary hearing last week, House Study Bill 526 would also add new categories to reporting requirements, including medical records. These requirements apply to personal data in any form – not just computerized data – and expand the definition of personal information.

Further, the proposed bill would require organizations to increase encryption of data to 128-bit if they want to be exempted from the breach reporting requirements.

The proposed bill comes on the heels of the Equifax breach announcement in 2017, which impacted 1.1 million Iowans. Iowa opened an investigation into Equifax after the announcement, which includes a multistate investigation by a group of bipartisan attorneys general.

[Also: Proposed Senate bill would fine, jail execs who conceal data breaches]

The state is the most recent to propose changes to its breach reporting requirements in light of the data breaches of Equifax, Verizon, Uber, Target and others.

In January, North Carolina proposed shortening its reporting requirements to just 15 days. A U.S. Senate bill proposed in December would fine and jail executives who conceal data breaches.

And just last week, a South Dakota Senate panel approved data breach legislation that would require all breaches of more than 250 people to be reported to the state within 60 days unless the company could prove consumers couldn’t be harmed as a result.

As the number and impact of breaches continue to expand, it’s likely states will continue to crack down on reporting requirements in an effort to protect consumers.

Twitter: @JessieFDavis
Email the writer: jessica.davis@himssmedia.com