0990-BreachAttachment B 092409

Attachment B

Estimates of Other Total Annual Cost Burden to Respondents or Recordkeepers

(Please note that all calculations have been rounded to the nearest cent)

For individual notice, our impact analysis has estimated that it will cost approximately $722,178 for postage and supplies to provide individual breach notification. This assumes only half of all the 2,888,804 notifications will be sent via first-class mail at a cost of $0.50 per notice.

For the 70 breaches for which substitute notification is required under § 164.404(d)(2), our impact analysis has estimated that it will cost covered entities $487 per breach to either post the notice on their web page for 3 months or to publish this information in major print or broadcast media for a total of $34,080 for all 70 breaches.

Additionally, with respect to the toll-free line that must be provided in cases where a covered entity is providing substitute notice, in our impact statement, we have estimated that the overall cost of providing the toll-free number is $8,237,309. Of this total, $7,222,025 is a result of the burden hours necessary to staff the phone line; however, the remaining $1,015,289 is the cost to covered entities for establishing a toll-free line for 3 months.

In our impact analysis, we have estimated that it will cost covered entities $4,200 to provide media notice. Of this total, $1,680 is due to the burden hours to prepare the media notice. The remaining $2,520 is the total annual cost burden to covered entities for providing media notice.

The total estimated capital and maintenance costs to covered entities for providing the required breach notification is $1,774,068.