# Assess Breach Notification Obligations Across Affected Jurisdictions > Multi-jurisdiction breach notification memos fail when the agent applies only federal frameworks and omits state-by-state notification deadlines, business-associate reporting chains, and cyber-insurance reporting obligations that may be triggered by the same incident. - Skill: `finchipaiorg/assess-breach-notification-obligations-across-affected-juris` (Agent Skill) - Install (CLI): `npx skillmds@latest add finchipaiorg/assess-breach-notification-obligations-across-affected-juris` - Raw SKILL.md: https://api.skillmd.com/api/skills/finchipaiorg/assess-breach-notification-obligations-across-affected-juris/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: FinchipAIOrg (https://skillmd.com/u/finchipaiorg) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/finchipaiorg/assess-breach-notification-obligations-across-affected-juris --- # Skill: Assess Breach Notification Obligations Across Affected Jurisdictions — Incident Response Memorandum ## 1. Subject-matter triage - Confirm the incident is a notification analysis, not a root-cause report or pure remediation plan. - Separate the discovery date, confirmation date, and incident timeline; deadline computation usually runs from discovery, while scope and sequencing come from the timeline. - Identify the data types implicated, the jurisdictions of affected persons, and the entities in the reporting chain before analyzing notice duties. - If the record is incomplete, flag what is confirmed versus what remains preliminary, but still assess whether precautionary notice is prudent under the governing rules. ## 2. Failure modes the skill is correcting - The agent addresses only federal notice rules and omits state-by-state deadlines, recipients, content requirements, and regulator filings. - The agent ignores that different parties may have independent reporting duties under contracts, vendor terms, business-associate arrangements, or service-provider commitments. - The agent conflates forensic validation with notice timing, instead of using the discovery trigger and the chronology in the investigative materials. - The agent overlooks cyber-insurance reporting and cooperation terms that may be triggered even when statutory notice is not yet due. - The agent states conclusions without tying them to the governing statute, regulation, or policy language that controls the result. - The agent gives analysis without a clear follow-on action plan, leaving counsel and operations without next-step ownership. ## 3. Legal frameworks / domain conventions that apply - HIPAA Breach Notification Rule: apply the covered-entity, business-associate, and media-notice framework; use the breach-risk assessment factors and the discovery-based timing rule in 45 C.F.R. §§ 164.400–414. - State breach notification statutes: identify each affected jurisdiction separately and apply that jurisdiction’s trigger, deadline, notice recipients, content requirements, and any attorney general or regulator filing obligation. - Federal privacy and sector rules: consider whether the incident also implicates FTC Act unfairness/deception theories, GLBA-related notice obligations, or other sector-specific reporting regimes if the affected population or data category makes them relevant. - EU/EEA or UK breach rules, if applicable: assess controller/processor reporting duties, supervisory-authority notice timing, and data-subject notification standards under GDPR Articles 33 and 34 or the UK GDPR equivalents. - Contractual reporting obligations: review the governing incident-response, data-processing, vendor, and customer agreements for notice chains, cooperation clauses, and any enhanced content or timing requirements. - Cyber-insurance policy terms: review notice, consent, cooperation, and panel-counsel requirements alongside statutory deadlines. ## 4. Analytical scaffolds - Start by enumerating the affected jurisdictions, then analyze each jurisdiction on its own terms; do not collapse multiple states or countries into a single generalized rule. - For each jurisdiction, identify: the triggering data type, the applicable deadline, the required notice recipients, any regulator or media notice, the content elements, and the party responsible for sending notice. - Tie each conclusion to the controlling authority by name and citation form used in the source materials or, if absent, by the generally recognized statute, regulation, or policy provision. - If the breach-risk standard is relevant, walk through the statutory or regulatory factors and anchor the assessment in the investigative record. - Cross-check the incident timeline against the discovery date to determine whether any notice clock has already started or expired. - Review the reporting chain in the source documents to determine whether a vendor, processor, business associate, or other intermediary must notify first or simultaneously. - Review the cyber-insurance policy for separate notice and cooperation deadlines, then reconcile those with the statutory notice timetable. - Where media notification depends on volume or audience thresholds, verify the threshold against the affected-population evidence before treating media notice as required. - If the evidence is still developing, distinguish between mandatory notice, prudential notice, and items that can wait for confirmation. ## 5. Vertical / structural / temporal relationships - Reporting chain first, external notice second: internal or upstream notice may be a prerequisite to downstream statutory notice. - Discovery date drives clock calculations; forensic completeness drives confidence in scope, not necessarily the start of the legal deadline. - The same incident may trigger overlapping obligations with different clocks, different recipients, and different content sets; analyze the shortest applicable deadline first. - Contractual and insurance deadlines may be shorter than statutory deadlines, so they should be checked in parallel rather than after the legal memo is complete. - Preliminary findings should be labeled as such, but counsel should still assess whether the legal risk of delay outweighs the risk of over-notification. ## 6. Output structure conventions - Draft a privileged breach-notification memorandum with a concise incident overview, a data and population summary, and a jurisdiction-by-jurisdiction notice analysis. - Use a matrix or table for each jurisdiction with columns for recipient, trigger, deadline, content requirements, responsible party, and current status. - Include a separate section for reporting-chain analysis, a separate section for insurance notice and cooperation terms, and a separate section for recommended immediate actions. - Organize the memo so that each legal conclusion is followed by the authority supporting it and the practical consequence for the client. - End with an explicit Recommended Actions section using imperative verbs, named responsible roles, and timing anchors tied to the incident timeline or applicable deadline. - Deliver the file exactly as instructed: `breach-notification-memo.docx`.