Missouri practices follow HIPAA plus Missouri's breach notification law, which specifically includes medical and health insurance information and requires attorney general notice for larger breaches.
AT A GLANCE
| Law | Mo. Rev. Stat. § 407.1500 |
|---|---|
| Data covered | Includes medical information (medical history, condition, treatment or diagnosis) and health insurance information, along with Social Security, ID and financial account numbers |
| Notice to residents | Without unreasonable delay |
| Attorney general | Notify the attorney general and consumer reporting agencies without unreasonable delay if more than 1,000 consumers are notified at one time |
| Regulated entities | Entities that give notice under the procedures of their primary or functional regulator are deemed compliant |
| Penalties | Attorney general may seek actual damages and civil penalties up to $150,000 per breach or related series of breaches. No private right of action |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
Yes. Missouri includes medical information and health insurance information in its definition of personal information.
If more than 1,000 consumers are notified at one time, notify the attorney general and consumer reporting agencies without unreasonable delay.
The attorney general can seek actual damages and civil penalties of up to $150,000 per breach or related series of breaches.
Sources: Constangy: Missouri summary · Davis Wright Tremaine: Missouri. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or talk to an analyst.
