Federal Exchange Data Breach Notification Act of 2015
This bill requires a health insurance exchange to notify each individual whose personal information is known to have been acquired or accessed as a result of a breach of security of any system maintained by the exchange as soon as possible but not later than 60 days after discovery of the breach.
A violation of this requirement is an unfair or deceptive act or practice under the Federal Trade Commission Act.