When a data breach requires individual notice, the letters are the last step in the process. They are also the step with the least flexibility.
That has always been true. What changed in 2026 is how little time is left for it.
On January 1, 2026, California’s SB 446 took effect. Where the state’s breach notification law previously required notice “without unreasonable delay,” it now sets fixed deadlines: 30 days to notify affected individuals, and 15 days to notify the Attorney General.
California is not an outlier here. It is an indicator of direction.
HIPAA allows up to 60 days from discovery for individual notice. Roughly 20 states now specify a numeric deadline, most commonly 30 or 45 days. The remaining states still use qualitative language.
When a single incident affects residents of several states, the shortest applicable deadline governs the schedule.
Most of the notification window is gone before printing starts
A notification timeline is consumed, in sequence, by work that must be completed before a letter can be produced:
- containment and forensic investigation
- scoping which data and which individuals were involved
- determining whether the incident is a reportable breach
- assembling and de-duplicating the recipient list
- drafting the notice
- counsel review, and often carrier review
The recipient list is usually the last item finished.
That means print and mail, the one step in the sequence with a physical constraint, receives whatever time remains. A 30-day obligation can reach production with four or five days left.
This is not a criticism of anyone’s process. Forensics and legal review take as long as they take. It does mean the mailing has to be planned for a compressed window rather than a comfortable one.
The mailing is not simply a print job
Organizations that have not run a notification mailing tend to picture printing with extra steps. The work that actually consumes time is elsewhere.
Address quality
Recipient lists are assembled under pressure from systems that were never designed to produce mailing files. Addresses are stale, incomplete, or duplicated across sources.
CASS and NCOA processing corrects what it can and flags what it cannot. Undeliverable mail is not only wasted postage. It is an incomplete notification, and it creates follow-up work that has to be handled later regardless.
Letter versions
There is rarely one letter. State-specific content requirements and different affected populations can each require a separate version, and each version requires its own review.
Composition, not printing, is the constraint. A provider that composes in-house can absorb a late change from counsel. A provider brokering the work cannot.
Mail class
First-class, Certified Mail, or Certified Mail with Electronic Return Receipt is a decision about cost and evidence. It should be made deliberately rather than by default.
Certified Mail increases per-piece cost significantly, and on a large population that difference is material. It also produces a stronger evidentiary record. Counsel should make that call with real numbers available.
Production capacity
“We can handle it” is not a production plan.
Whether a quarter-million letters can be composed, printed, inserted, and accepted by USPS inside 48 hours is a factual question. It is reasonable to ask for the specific answer.
Proof of mailing is the part that gets tested later
Notification is not complete when the letters leave the building. It is complete when the organization can prove they left.
Regulator inquiries and civil claims tend to arrive long after an incident has left everyone’s daily attention.
At that point the question is not whether the organization intended to notify on time. It is whether it can demonstrate what was mailed, to whom, and on what date.
A complete evidence package generally includes:
- an affidavit of mailing
- a mailing manifest tying each recipient to each piece
- USPS acceptance records
- return receipt data where Certified Mail with ERR was used
- a log of returned and undeliverable mail
Documentation assembled months later from partial records is measurably weaker in a dispute. The evidence should be produced as a byproduct of the mailing itself, not reconstructed afterward.
Questions to ask a mailing provider before there is an incident
For breach counsel, incident response firms, and covered entities building a response plan, this is a reasonable due-diligence list:
- Will you sign a BAA, and can you produce a current SOC 2 report?
- How does data reach you, and who internally can access it?
- What is the retention and destruction schedule for matter data?
- What turnaround will you commit to in writing, measured from approved data file?
- Is weekend and holiday production available, and at what notice?
- Is composition handled in-house or subcontracted?
- What evidence package is delivered, and in what format?
- How is return mail captured and reported?
A provider who cannot answer these quickly is telling you something useful.
The paperwork belongs in front of the incident
The most effective way to protect a compressed timeline is to complete vendor onboarding before anything happens.
Executing an MSA and BAA during an active incident routinely costs two to four days. Those days come directly out of the notification window, and they are spent on contract review rather than on notifying anyone.
Firms that handle breach matters regularly keep a mailing provider on standing paperwork for this reason. It reduces the mailing step from a procurement exercise to a phone call.
Work with a breach notification mailing partner
Electronic Output Solutions (EOS) produces breach notification mailings under SOC 2 examined controls as a HIPAA business associate, with production facilities in California and Texas.
Our dedicated service for incident-driven matters is NotifyCertain, where you can review how a matter runs end to end or start a matter.
To discuss standing onboarding for your firm, or a matter already underway, call (760) 599-9945 or contact service@eoshost.com.
EOS provides production and mailing services only and does not provide legal advice. Responsibility for the content, timing, and legal sufficiency of any notification rests with the client and its counsel. Statutory deadlines described here are summarized for general information and change over time. Confirm current requirements for your jurisdictions with counsel.