{ "name": "Batesio Secure Transfer Obligations", "title": "Secure Transfer Obligations", "url": "https://batesio.com/datasets/secure-transfer-obligations/", "csv": "https://batesio.com/datasets/secure-transfer-obligations.csv", "markdown": "https://batesio.com/datasets/secure-transfer-obligations/index.md", "computed_at": "2026-10-18", "license": "https://batesio.com/terms", "headline": "The Secure Transfer Obligations carries 3 published figures read from 5 sources' own pages, from 30 to 90 day, read 17 October 2026.", "quotes": [ "The Secure Transfer Obligations carries 3 published figures read from 5 sources' own pages, from 30 to 90 day, read 17 October 2026.", "5 of the 16 named sources read in full publish a figure; 11 publish none, read 17 October 2026.", "Secure Transfer Obligations, regime ftc-safeguards: median 30 day across 1 source, read 17 October 2026.", "Secure Transfer Obligations, regime hipaa-security-guidance: median 12 month across 1 source, read 17 October 2026.", "Secure Transfer Obligations, regime hipaa-breach-notification: median 60 day across 1 source, read 17 October 2026.", "Secure Transfer Obligations, regime 45-cfr-164-subpart-d: median 90 day across 1 source, read 17 October 2026.", "Secure Transfer Obligations, regime hipaa-security-nprm: median 12 month across 1 source, read 17 October 2026." ], "citation": "\"Batesio Secure Transfer Obligations\", updated 2026-10-18, https://batesio.com/datasets/secure-transfer-obligations/.", "changed_since": null, "national": { "unit": "day", "n": 3, "median": 60, "min": 30, "max": 90, "p25": 30, "p75": 90, "mean": 60, "units": { "day": 3, "month": 2 }, "published_sources": 5, "named_sources": 16, "read_sources": 16, "not_published": 11, "published_share": 0.312 }, "by_axis": { "regime": { "ftc-safeguards": { "day": { "n": 1, "median": 30, "min": 30, "max": 30, "p25": 30, "p75": 30, "mean": 30 } }, "hipaa-security-guidance": { "month": { "n": 1, "median": 12, "min": 12, "max": 12, "p25": 12, "p75": 12, "mean": 12 } }, "hipaa-breach-notification": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "45-cfr-164-subpart-d": { "day": { "n": 1, "median": 90, "min": 90, "max": 90, "p25": 90, "p75": 90, "mean": 90 } }, "hipaa-security-nprm": { "month": { "n": 1, "median": 12, "min": 12, "max": 12, "p25": 12, "p75": 12, "mean": 12 } } } }, "rows": [ { "source": "FTC Safeguards Rule: what your business needs to know", "url": "https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "regime": "ftc-safeguards" }, "retrieved_at": "2026-10-17", "quote": "Section 314.4(j) of the Safeguards Rule requires financial institutions to notify the FTC as soon as possible – and no later than 30 days after discovery – of a “notification event.” For purposes of the Rule, a “notification event” is a security breach involving the unauthorized acquisition of at least 500 consumers’ unencrypted information.", "source_class": "primary-government", "text_sha256": "9f1542b886ecb037ec05446304d24f573c89c32539078ec8ed09f929c1c13efd" }, { "source": "HHS: Security Rule guidance material", "url": "https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html", "figure": "12 months", "value": 12, "unit": "month", "vat": null, "axis": { "regime": "hipaa-security-guidance" }, "retrieved_at": "2026-10-17", "quote": "The statute requires OCR to take into consideration in certain Security Rule enforcement and audit activities whether a regulated entity has adequately demonstrated that recognized security practices were “in place” for the prior 12 months.", "source_class": "primary-government", "text_sha256": "b9659958d2b7b60ee488a71f3f4190fdb1f57c145d7a0feada194006053d0920" }, { "source": "HHS: breach reporting to the Secretary", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "regime": "hipaa-breach-notification" }, "retrieved_at": "2026-10-12", "quote": "Within 60 days after the end of the calendar year in which the breach was discovered", "source_class": "primary-government", "text_sha256": "57dcbbfdf9e2f6bf9c6db752c7d092c8e14d8ca9d2c6aabc3b00d1d4f5cc0d4d" }, { "source": "eCFR 45 CFR part 164 subpart D (breach notification)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "regime": "45-cfr-164-subpart-d" }, "retrieved_at": "2026-10-17", "quote": "(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and", "source_class": "primary-government", "text_sha256": "5b2dd02280a8d60654d8d612f7811cb25cba72fdf077d28b6eae1bdc2085b118" }, { "source": "HHS: Security Rule NPRM fact sheet", "url": "https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html", "figure": "12 months", "value": 12, "unit": "month", "vat": null, "axis": { "regime": "hipaa-security-nprm" }, "retrieved_at": "2026-10-17", "quote": "Require the development and revision of a technology asset inventory and a network map that illustrates the movement of ePHI throughout the regulated entity’s electronic information system(s) on an ongoing basis, but at least once every 12 months and in response to a change in the regulated entity’s environment or operations that may affect ePHI.", "source_class": "primary-government", "text_sha256": "ac3b94ed3e9f3d782fb6a4d8fe544562624bfe761818497ae3683b8697aef802" } ], "not_published": [ { "source": "HHS: HIPAA Security Rule laws and regulations", "url": "https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS: the Security Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS: guidance on HIPAA and cloud computing", "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS: business associates FAQ", "url": "https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "eCFR 45 CFR 164.312 technical safeguards", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS: minimum necessary requirement", "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "FTC: Gramm-Leach-Bliley Act", "url": "https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO: a guide to data security (UK GDPR)", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/", "retrieved_at": "2026-10-11", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO: encryption", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "NIST SP 800-66r2: implementing the HIPAA Security Rule", "url": "https://csrc.nist.gov/pubs/sp/800/66/r2/final", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "NIST Cybersecurity Framework", "url": "https://www.nist.gov/cyberframework", "retrieved_at": "2026-10-11", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html", "label": "HHS: HIPAA Security Rule laws and regulations", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html", "label": "HHS: Security Rule guidance material", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "label": "HHS: the Security Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html", "label": "HHS: guidance on HIPAA and cloud computing", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html", "label": "HHS: business associates FAQ", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html", "label": "HHS: breach reporting to the Secretary", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html", "label": "HHS: Security Rule NPRM fact sheet", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312", "label": "eCFR 45 CFR 164.312 technical safeguards", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D", "label": "eCFR 45 CFR part 164 subpart D (breach notification)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html", "label": "HHS: minimum necessary requirement", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know", "label": "FTC Safeguards Rule: what your business needs to know", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act", "label": "FTC: Gramm-Leach-Bliley Act", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/", "label": "ICO: a guide to data security (UK GDPR)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/", "label": "ICO: encryption", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://csrc.nist.gov/pubs/sp/800/66/r2/final", "label": "NIST SP 800-66r2: implementing the HIPAA Security Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.nist.gov/cyberframework", "label": "NIST Cybersecurity Framework", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 5 of the 16 named sources that could be read published a usable figure; 11 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 9 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per requirement, quoted verbatim from the regulator with its effective date and its status (required, addressable, proposed), so a reader can see that HIPAA makes encryption ADDRESSABLE today and that the December 2024 NPRM would make it required; the cross-regime comparison - what HIPAA, the FTC Safeguards Rule and UK GDPR each demand of the same transfer - is the figure; changed-since, which is the news when a rule is finalised", "embed": "

30 to 90 day

3 published figures, Secure Transfer Obligations, across 5 sources, read 17 October 2026

Source: Batesio Secure Transfer Obligations
" }