Oklahoma healthcare practices follow HIPAA first, and Oklahoma's Security Breach Notification Act adds its own rules when certain personal information is exposed. The law was updated by Senate Bill 626, effective January 1, 2026, which added attorney general reporting and new data types.
AT A GLANCE
| Law | Security Breach Notification Act, Okla. Stat. tit. 24, §§ 161 to 166, as amended by SB 626 (effective January 1, 2026) |
|---|---|
| Data covered | Name plus a Social Security number, driver license or state ID, other government-issued unique ID numbers, financial account access information, or biometric data used for authentication |
| Notice to residents | Without unreasonable delay |
| Attorney general | Required for breaches affecting 500 or more Oklahoma residents (1,000 for credit bureaus), within 60 days after notifying residents |
| HIPAA entities | Entities that comply with HIPAA are deemed compliant with Oklahoma's resident notice rules, but must still give any required attorney general notice |
| Penalties | Civil penalties up to $150,000 per breach. Entities that used reasonable safeguards and gave proper notice are protected from civil penalties; if notice was given without reasonable safeguards, penalties are capped at $75,000 plus actual damages |
02
Hospitals should also review the Oklahoma Hospital Cybersecurity Protection Act.
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
Medical information is not one of the data elements listed in the Oklahoma statute. A breach of patient records is mainly governed by HIPAA, but if the same breach exposes Social Security, ID or financial account numbers, Oklahoma's law can apply too.
When a breach affects 500 or more Oklahoma residents (1,000 or more for credit bureaus), within 60 days after notifying the affected residents.
Entities that comply with HIPAA are deemed compliant with Oklahoma's individual notice requirements, but they still have to send any required notice to the attorney general.
Civil penalties can reach $150,000 per breach. Using reasonable safeguards and giving proper notice protects against civil penalties.
Sources: Covington: Oklahoma amends breach statute · Oklahoma Legislature SB 626 summary. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or talk to our Tulsa team.
