Hacked? What Portland CPAs, Financial Advisors, and Medical Offices Must Report After a Data Breach (and the Fines If You Don’t)

If you run a CPA firm, tax practice, financial advisory office, or medical clinic anywhere from Hillsboro to Gresham or Wilsonville to Vancouver, WA, a breach starts several reporting clocks at once, and some of them run in days, not months.

This guide covers the data breach reporting requirements for small and mid-size offices in Oregon and Washington: who you report to, the deadlines, the official links, and the penalties the regulators publish. CPAs, tax preparers, and financial advisors get their own sections, because they often answer to the most agencies.

This is general information, not legal advice. Every breach is different. Bring in breach counsel early.

The First 72 Hours: A Practical Checklist

1. Contain it. Disconnect affected computers from the network, but don’t power them off or wipe them. Disable compromised accounts and reset passwords from a clean device.
2. Call your IT provider or MSP to stop the attack, find out how the attacker got in, and keep the evidence intact.
3. Preserve logs and evidence. Save firewall, email, Microsoft 365, EHR, tax-software, and server logs. Screenshot ransom notes. Don’t delete phishing emails.
4. Call your cyber insurer and breach counsel. Many policies require prompt notice and approved vendors. Counsel can direct the investigation.
5. Report the crime to the FBI’s IC3, the FBI Portland or Seattle field office, and local police. You can also report to CISA.
6. Figure out what data was exposed, and whose. Patient records, SSNs, tax returns, account numbers? Which states do the affected people live in? That decides which rules below apply.
7. Start the notification clock. Most deadlines run from discovery, not from the end of your investigation. Write down when you first learned of it.

Medical and Dental Offices: HIPAA

For HIPAA covered entities, the HHS Breach Notification Rule (45 CFR 164.400–414) applies to breaches of unsecured protected health information. Properly encrypted data is generally exempt.

• Patients: without unreasonable delay, no later than 60 days after discovery.
• HHS OCR: 500 or more people, within 60 days. Fewer than 500, report within 60 days after the calendar year ends. File at the HHS OCR Breach Portal.
• Media: if more than 500 residents of a state are affected, within 60 days.
• Business associates must notify the covered entity within 60 days.

HIPAA penalties (as of 2026)

HHS’s January 28, 2026 inflation adjustment sets civil penalties per violation at:

Under a 2019 notice of enforcement discretion, HHS applies lower annual caps for the first three tiers (base amounts of $25,000, $100,000, and $250,000, adjusted for inflation).

Criminal penalties under 42 U.S.C. 1320d-6 for knowingly misusing health information: up to $50,000 and 1 year; $100,000 and 5 years under false pretenses; $250,000 and 10 years for gain or malicious harm.

Non-HIPAA health apps fall under the FTC’s Health Breach Notification Rule: 60 days, with the FTC notified at the same time if 500+ are affected. The penalty is up to $53,088 per violation, a level the FTC kept for 2026.

CPAs and Tax Preparers

FTC Safeguards Rule

The FTC lists tax preparation firms as “financial institutions,” so the FTC Safeguards Rule (16 CFR Part 314) applies to you. It also covers mortgage brokers, collection agencies, and investment advisors not registered with the SEC.

• Report to the FTC as soon as possible, and no later than 30 days after discovery, if unencrypted information of 500 or more consumers was acquired without authorization. Use the FTC Safeguards Rule reporting form. Your report may be made public.
• You need a written information security program, including a Qualified Individual, risk assessment, MFA, encryption, and a written incident response plan.
• Penalties: the rule doesn’t list a fixed fine. They vary.

IRS requirements

IRS Publication 4557 says “Protecting taxpayer data is the law.” Preparers need a written information security plan (WISP), and the IRS warns that not having one “may result in an FTC investigation.” Publication 5708 has a template.

If client data is stolen, the IRS’s data theft guidance says to:

• Report it to your IRS Stakeholder Liaison right away. “Speed is critical,” because the IRS can block fraudulent returns. Oregon and Washington are in Area 6 (202-317-4015, cl.sl.area.6@irs.gov).
• Notify the state tax agency in every state where you prepare returns. The Federation of Tax Administrators keeps a list of contacts.

Oregon Department of Revenue: 5 days

Oregon has its own, much shorter deadline. Under ORS 305.804, CPAs, tax preparers, enrolled agents, and attorneys must notify the Oregon Department of Revenue within five days of discovering a breach, or of having reason to believe one happened. Include each affected client’s name, address, and tax ID, along with your PTIN. Call 503-947-2000 or email Fraud.help@dor.oregon.gov. If the data is locked by ransomware, DOR says to contact it again within 15 days after you recover the data.

Board of accountancy

Washington’s WAC 4-30-050 bars disclosing confidential client information without consent unless the law requires it, so have counsel review your notices. We found no official Oregon or Washington rule requiring a breach report to the board itself.

Financial Advisors and Broker-Dealers

SEC-registered advisors and broker-dealers: Regulation S-P

The SEC’s amended Regulation S-P covers broker-dealers, SEC-registered advisers, funds, funding portals, and transfer agents.

• Notify affected customers within 30 days of learning that sensitive customer information was, or likely was, accessed or used without authorization.
• Service providers must notify you within 72 hours of a breach affecting your customer information.
• Compliance dates: larger entities December 3, 2025; smaller entities June 3, 2026. As of 2026, both are in effect.
• Penalties: no fixed amounts in the rule; they vary.

FINRA (broker-dealers)

FINRA encourages firms to report cybersecurity events, including vendor incidents, to their Risk Monitoring Analyst. Ask counsel whether a Rule 4530 filing is triggered. Sanctions vary.

State-registered advisors (Oregon DFR and Washington DFI)

State-registered advisors are on the FTC’s Safeguards Rule list, so the 30-day/500-consumer FTC report applies, plus your state breach law.

• Washington: WAC 460-24A-200 requires written cybersecurity policies, and DFI proposed a NASAA-based cybersecurity rule in 2026. Contact the DFI Securities Division about incidents. DFI can fine registrants up to $10,000 per act or omission (RCW 21.20.110). DFI’s Consumer Services licensees, such as mortgage brokers, must report every breach to csenforcecomplaints@dfi.wa.gov.
• Oregon: the Division of Financial Regulation has tied cybersecurity and client-credential risks to advisors’ fiduciary duty (OAR 441-205-0145). We found no DFR-specific breach deadline, so contact DFR and follow Oregon’s breach law. Oregon Securities Law allows penalties up to $20,000 per violation (ORS 59.995).

Banks, Credit Unions, and Insurance

• Banks: notify your primary federal regulator (OCC, FDIC, or Fed) within 36 hours of determining a “notification incident” occurred (12 CFR 304.23, Part 53, Part 225 Subpart N).
• Federally insured credit unions: notify NCUA within 72 hours (12 CFR 748.1).
• Washington insurance licensees: notify the Insurance Commissioner within two business days after determining that consumer notice is required (WAC 284-04-625).

Oregon and Washington State Breach Laws

Oregon (ORS 646A.600–628)

• Consumers: notice within 45 days of discovery (ORS 646A.604).
• Oregon Attorney General: if more than 250 Oregonians are affected, use the DOJ breach form. HIPAA- or GLBA-compliant entities still owe the AG a copy of their notice.
• Over 1,000 consumers: also notify the national credit bureaus.
• Penalties: up to $1,000 per violation, capped at $500,000 per occurrence (ORS 646A.624). A violation is also an unlawful trade practice, and willful violations can carry up to $25,000 per violation (ORS 646.642).

Washington (RCW 19.255.010)

• Consumers: notice within 30 days of discovery (RCW 19.255.010).
• Washington Attorney General: within 30 days if more than 500 Washingtonians are affected, using the AG’s web form. HIPAA covered entities still notify the AG, but on HIPAA’s timeline (RCW 19.255.030).
• Penalties: the AG enforces through the Consumer Protection Act, with civil penalties up to $7,500 per violation (RCW 19.86.140). Consumers can also sue for damages.

Summary Table

FAQ

If our data was encrypted, do we still have to report? Often not, because these rules focus on unencrypted data. That changes if the encryption key was also stolen.

Our vendor was breached, not us. Are we off the hook? No. Vendors must tell you, but the duty to notify patients and clients usually stays with you.

Can police ask us to delay notice? Yes. Oregon, Washington, HIPAA, and the FTC allow delays at law enforcement’s request. Get it in writing.

We have Oregon and Washington clients. Which law applies? Both. Each protects its own residents, so Washington’s 30-day deadline applies to any affected Washington client.

Get Ready Before It Happens

These deadlines are much easier to meet with a written incident response plan, tested backups, MFA, and logs you can actually pull. PDX Information Technology Services helps clinics, CPA firms, tax preparers, and financial advisors across the Portland and Vancouver area prepare incident response plans and put HIPAA and FTC Safeguards Rule security in place. When we need access to systems with patient data, we sign a Business Associate Agreement.

Call us at 971-331-4871 or visit pdxittech.com to talk it through.

PDX Information Technology Services, 8215 SW Tualatin-Sherwood Rd, Suite 200, Tualatin, OR 97062

Disclaimer: This article is general information, not legal advice, and reflects official sources reviewed in October 2026. Laws and penalty amounts change. Consult qualified breach counsel about your specific situation.

Sources

• HHS, Breach Notification Rule: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• HHS OCR Breach Portal: https://ocrportal.hhs.gov/ocr/breach/
• HHS, Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (Jan. 28, 2026): https://www.govinfo.gov/content/pkg/FR-2026-01-28/html/2026-01688.htm
• HHS, Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151 (Apr. 30, 2019): https://www.govinfo.gov/content/pkg/FR-2019-04-30/html/2019-08530.htm
• 42 U.S.C. 1320d-6 (2024 ed.): https://www.govinfo.gov/content/pkg/USCODE-2024-title42/html/USCODE-2024-title42-chap7-subchapXI-partC-sec1320d-6.htm
• FTC, Complying with FTC’s Health Breach Notification Rule: https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0
• FTC, Civil Penalty Inflation Adjustments, 91 FR 58446 (Sept. 15, 2026): https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18853.htm
• FTC, Safeguards Rule: What Your Business Needs to Know: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
• FTC, Safeguards Rule Security Event Reporting Form: https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act/safeguards-rule-form
• IRS Publication 4557 (Rev. 5-2024): https://www.irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708: https://www.irs.gov/pub/irs-pdf/p5708.pdf
• IRS, Data theft information for tax professionals: https://www.irs.gov/individuals/data-theft-information-for-tax-professionals
• IRS, Stakeholder Liaison contacts: https://www.irs.gov/businesses/small-businesses-self-employed/stakeholder-liaison-contacts
• Federation of Tax Administrators, Report a Data Breach: https://taxadmin.org/report-a-data-breach-for-businesses/
• ORS 305.804: https://www.oregonlegislature.gov/bills_laws/ors/ors305.html
• Oregon DOR, Notice of data and security breach: https://www.oregon.gov/dor/pages/notice-of-data-breach.aspx
• WAC 4-30-050: https://app.leg.wa.gov/WAC/default.aspx?cite=4-30-050
• SEC, Enhancements to Regulation S-P: Small Entity Compliance Guide: https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf
• FINRA, Cybersecurity Advisory: Third-Party Provider Risks: https://www.finra.org/rules-guidance/guidance/cybersecurity-advisory-third-party-provider-risks
• FINRA Rule 4530: https://www.finra.org/rules-guidance/rulebooks/finra-rules/4530
• WAC 460-24A-200: https://app.leg.wa.gov/wac/default.aspx?cite=460-24A-200
• WA DFI, Investment Advisers CR-102 (2026): https://dfi.wa.gov/sites/default/files/2026-07/investment-advisers-cr-102.pdf
• WA DFI, Data Security Reporting Requirements (Winter 2026): https://dfi.wa.gov/newsletter/winter-2026-division-consumer-services/data-security-reporting-requirements-and
• RCW 21.20.110: https://app.leg.wa.gov/RCW/default.aspx?cite=21.20.110
• Oregon DFR, Investment Adviser Alert (Mar. 17, 2025): https://dfr.oregon.gov/business/licensing/financial/securities/Documents/investment-adviser-alert-20250317.pdf
• ORS 59.995: https://www.oregonlegislature.gov/bills_laws/ors/ors059.html
• 12 CFR Part 304 Subpart C (FDIC): https://www.ecfr.gov/current/title-12/chapter-III/subchapter-A/part-304/subpart-C
• 12 CFR Part 53 (OCC): https://www.ecfr.gov/current/title-12/chapter-I/part-53
• 12 CFR Part 225 Subpart N (Federal Reserve): https://www.ecfr.gov/current/title-12/chapter-II/subchapter-A/part-225/subpart-N
• 12 CFR 748.1 (NCUA): https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748
• WAC 284-04-625: https://app.leg.wa.gov/WAC/default.aspx?cite=284-04-625
• ORS 646A.600–628: https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html
• ORS 646.642: https://www.oregonlegislature.gov/bills_laws/ors/ors646.html
• Oregon DOJ, Data Breaches: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/data-breaches/
• Oregon DOJ, Submit Data Breach Notice: https://justice.oregon.gov/consumer/DataBreach/Home/Submit
• RCW 19.255.010 and chapter 19.255: https://app.leg.wa.gov/RCW/default.aspx?cite=19.255&full=true
• RCW 19.86.140: https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.140
• WA Attorney General, Data Breach Notifications: https://www.atg.wa.gov/data-breach-notifications
• FBI IC3: https://www.ic3.gov/
• CISA, Report: https://www.cisa.gov/report