Beginning in April 2022, banking organizations and bank service providers will be subject to the shortest regulatory breach notification reporting time frame of any law to date – 36 hours.
The Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (Board), and the Office of the Comptroller of the Currency (OCC) (collectively, the “Agencies”) have issued a final rule to establish cybersecurity breach notification requirements for banking organizations and bank service providers (Rule).
The Rule contains a 36-hour regulatory notification requirement for incidents that rise to the level of “notification events.” This timeline is shorter than any U.S. state data breach notification law and surpasses even the tightest time frame on U.S. books – 72 hours under the New York State Department of Financial Services and certain state insurance laws. Banking organizations will need to act quickly to make notifications to their primary regulators once they determine a “Notification Event” has taken place.
While the timeline is constricted, the clock doesn’t start until the banking organization “determines that a notification incident has occurred.” This contrasts with other breach notification laws that set timeframes based on when an organization becomes aware of an incident. In the summary of the Rule, the Agencies stated that they anticipate banking organizations will take “a reasonable amount of time” to determine whether a Notification...
A Delaware County doctor has agreed to pay more than $1.6 million back after admitting to filing more than 27,000 fraudulent Medicaid claims. Dr. Patrick Muffley, 56, of Lewis Center, pleaded guilt...