Oregon Data Breach Notification Law: A Grants Pass & Medford Guide

If a laptop with your client list walks out of the office, or someone gets into your email, the Oregon data breach notification law sets the clock on what you have to do next. The law’s formal name is the Oregon Consumer Information Protection Act, and it runs from ORS 646A.600 through 646A.628. Section 646A.600 itself is just the short title; the rules live in the sections after it, mainly 646A.602 (definitions), 646A.604 (who you notify and when) and 646A.622 (the safeguards you’re expected to have in place). This guide walks a vet clinic, an accounting office or a restaurant in Jackson or Josephine County through those three sections in plain English.

One caveat up front: we’re an IT company, not a law firm, and this isn’t legal advice. The law was first passed in 2007 and, according to the Oregon Department of Justice, was “updated as recently as 2019”. If you’re dealing with a real incident, call your attorney alongside your IT provider.

What counts as a breach, and what counts as personal information

The law defines a breach as “an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information”. An employee opening the wrong file by mistake isn’t a breach, as long as the data isn’t misused. A stranger getting hold of it is.

“Personal information” is narrower than most owners expect. It means a first name or initial plus a last name, combined with one of a specific list of data elements:

• Social Security number
• Driver license or state ID number
• Passport or other US-issued ID number
• A card or financial account number together with the code or password needed to use it
• Biometric data such as fingerprints used to confirm identity
• Health insurance policy or subscriber ID number
• Medical history or diagnosis

A username plus the password needed to log in also counts on its own. Encryption helps, but only if the encryption key wasn’t taken too. And “consumer” means someone who lives in Oregon, so customers from out of state fall under their own states’ laws instead.

Here’s what that means for the three types of business this post is written for. This is our reading, so confirm it with your attorney:

• Restaurants. Card numbers on their own aren’t personal information under this law; they have to be paired with the code or password that lets someone use the account. Your more likely exposure is the back office: staff Social Security numbers, payroll files and the logins for your point-of-sale and other restaurant IT systems.
• Vet clinics. The law covers Oregon residents, so a dog’s chart probably isn’t “medical history” in the legal sense. Owners’ card details, client portal logins and employee records are.
• Accountants. Client files are full of Social Security numbers and bank account details, which puts accounting firms squarely inside the law. There are routes for businesses already following stricter federal rules, covered below.

The 45-day customer notice

Once you discover a breach, or a vendor tells you about one, you have to notify affected Oregon residents “in the most expeditious manner possible, without unreasonable delay, but not later than 45 days”. The only permitted reason to wait longer is a written request from law enforcement saying notice would hurt a criminal investigation.

Before notice goes out, the law expects you to take reasonable steps to work out how big the breach is, find contact details for the people affected, and restore the security of the data. Notice can go by letter, by email if that’s how you normally contact the customer, or by phone if you speak with them directly.

The notice itself has a required minimum:

• A general description of what happened and its approximate date
• The types of information involved
• Your contact information
• Contact information for the national credit bureaus
• Advice to report suspected identity theft to law enforcement, the Attorney General and the FTC

Two more points worth knowing. If more than 1,000 people are affected, you also have to tell the nationwide credit bureaus, and you can’t delay the customer notices to do it. And if you decide, after investigating or talking with law enforcement, that the people affected are unlikely to be harmed, you don’t have to send notice at all. But you have to write that decision down and keep it for at least five years. “We figured it was fine” isn’t a record.

Telling the Attorney General when more than 250 Oregonians are affected

If the number of Oregon residents you need to notify is more than 250, you also have to notify the Oregon Attorney General, in writing or electronically. The threshold is “more than 250,” so 251 people triggers it and 250 doesn’t.

The DOJ says the report, along with a sample copy of the customer notice, goes to its office within the same 45-day window, through the DOJ’s online data breach notice form or by emailing databreach@doj.oregon.gov. The DOJ’s Privacy Unit reviews every report it receives.

For a 12-person accounting firm, 251 clients is not a large number. For a restaurant with a loyalty program or a clinic with years of client records, it’s small.

The 10-day vendor duty

This is the part most relevant to anyone who outsources IT, payroll or cloud hosting. The law defines a vendor as a business you hire to store, manage, process or access personal information on your behalf. A vendor that finds a breach, or has reason to believe one happened, has to tell you “as soon as is practicable but not later than 10 days”. A subcontractor owes the same duty to the vendor above it.

If the vendor can’t tell how many people were affected, or the number is more than 250, the vendor has to notify the Attorney General itself unless you already have. Your own 45 days start when you discover the breach or when the vendor tells you, so a vendor that sits on bad news for a week eats into your time.

Practical takeaway: when you sign with an IT provider, a payroll service or a cloud host, ask how they’d tell you about a breach and how fast. The law gives them 10 days. A good provider should be far quicker than that.

What “reasonable safeguards” means for a Jackson or Josephine County small business

The notice rules are what happens after a breach. ORS 646A.622 is what you’re expected to do before one. Any business holding personal information has to “develop, implement and maintain reasonable safeguards”, including when it disposes of the data.

The good news for a small business is that the law scales. A small business complies if its program has administrative, technical and physical safeguards suited to its size, complexity, activities and the sensitivity of the data. A three-chair vet clinic isn’t held to a hospital’s standard. The statute then lists examples in three groups.

Administrative

• Name one person to coordinate security
• Identify risks regularly and check whether current safeguards handle them
• Train staff regularly
• Choose service providers that can keep data safe, and require it by contract
• Review who has access to what, regularly

Technical

• Assess network and software risks and fix them in a reasonable time
• Install security updates under a reasonable patching program
• Monitor for, detect and respond to attacks and system failures
• Test key controls regularly

Physical

• Protect data from collection through disposal
• Detect and respond to intrusions in good time
• When records are no longer needed, shred or pulverize the paper and erase electronic media so the data can’t be read or rebuilt; hiring a record-destruction company counts

If you read that list and thought “that’s a to-do list for an IT provider,” you’re right. Patching, monitoring, access reviews and tested backups are exactly what managed IT services cover, and they’re also what makes the difference between a breach you can scope in a day and one you’re still untangling at day 40. We’ve written about the recovery side in what a Southern Oregon business should do after ransomware.

Businesses already following stricter federal rules have another route: the law treats compliance with the Gramm-Leach-Bliley Act or HIPAA/HITECH as compliance with the safeguards requirement, for data those laws cover. The notice rules work the same way, with one catch: even an exempt business must send the Attorney General a copy of any breach notice when more than 250 Oregon residents are affected.

What happens if you get it wrong

Breaking the law is an “unlawful practice” under ORS 646.607, which puts it in the same category as other consumer-protection violations. The DOJ and the Department of Consumer and Business Services share enforcement, and the DOJ says it can seek civil penalties for late notice or for failing to keep reasonable safeguards. Consumers can’t sue you under this law directly; there’s no private right of action. We’re not going to quote a fine amount here because penalties depend on the case, and that’s a question for your attorney.

The Oregon data breach notification law in Grants Pass and Medford: a short checklist

1. Know what you hold. List where names sit next to Social Security numbers, card codes, ID numbers or logins: client files, payroll, point-of-sale, the client portal.
2. Name a coordinator. The law asks for one. In a small office it’s often the owner plus the IT provider.
3. Write a one-page plan. Who you call first, how you’d scope the breach, and where the 45-day and 10-day clocks start.
4. Put the vendor duty in writing. Ask every provider that touches your data how and when they’d tell you about a breach.
5. Keep records. If you ever decide notice isn’t needed, document why and keep it for five years.

How we help

ITs Managed has supported small businesses in Grants Pass, Medford, Ashland and the rest of Jackson and Josephine counties since 1989. The technical safeguards in ORS 646A.622, such as patching, monitoring, access control, backups and disaster recovery, are the day-to-day work of our cybersecurity and proactive network monitoring services. If something does go wrong, our guaranteed emergency response time means you get help scoping the problem while the 45-day clock is still mostly unused, and we explain what happened in plain English so you can brief your attorney and your customers.

Not sure whether your office would pass the “reasonable safeguards” test? Contact us and we’ll walk through it with you.