“In the most expedient time possible…”

The article examines widespread delays in breach notification—especially for HIPAA-regulated healthcare organizations—illustrating how state and federal rules often allow extended or vague notification windows. It notes multiple examples of late or absent disclosures, recent enforcement settlements, and observed ransomware gang leak-site postings of U.S. medical entities' protected health information, and argues that entities should be required to notify the public promptly (proposed within 48 hours) when threat actors leak sensitive data.