{ "name": "Clipboardo Intake Compliance Rules", "title": "Intake Compliance Rules", "url": "https://clipboardo.com/datasets/intake-compliance-rules/", "csv": "https://clipboardo.com/datasets/intake-compliance-rules.csv", "markdown": "https://clipboardo.com/datasets/intake-compliance-rules/index.md", "computed_at": "2026-10-18", "license": "https://clipboardo.com/terms", "headline": "The Intake Compliance Rules carries 8 published figures read from 3 sources' own pages, from 30 to 90 day, read 17 October 2026.", "quotes": [ "The Intake Compliance Rules carries 8 published figures read from 3 sources' own pages, from 30 to 90 day, read 17 October 2026.", "3 of the 14 named sources read in full publish a figure; 11 publish none, read 17 October 2026.", "Intake Compliance Rules, requirement breach notice posting: median 90 day across 1 source, read 17 October 2026.", "Intake Compliance Rules, requirement breach toll-free line: median 90 day across 1 source, read 17 October 2026.", "Intake Compliance Rules, requirement revised privacy notice: median 60 day across 2 sources, read 17 October 2026.", "Intake Compliance Rules, requirement act on an access request: median 30 day across 1 source, read 17 October 2026.", "Intake Compliance Rules, requirement act on an amendment request: median 60 day across 1 source, read 17 October 2026.", "Intake Compliance Rules, requirement opt-out request: median 30 day across 1 source, read 17 October 2026.", "Intake Compliance Rules, requirement do-not-call list version: median 31 day across 1 source, read 17 October 2026." ], "citation": "\"Clipboardo Intake Compliance Rules\", updated 2026-10-18, https://clipboardo.com/datasets/intake-compliance-rules/.", "changed_since": null, "national": { "unit": "day", "n": 8, "median": 60, "min": 30, "max": 90, "p25": 30.25, "p75": 82.5, "mean": 56.375, "units": { "day": 8 }, "published_sources": 3, "named_sources": 16, "read_sources": 14, "not_published": 11, "published_share": 0.214 }, "by_axis": { "requirement": { "breach notice posting": { "day": { "n": 1, "median": 90, "min": 90, "max": 90, "p25": 90, "p75": 90, "mean": 90 } }, "breach toll-free line": { "day": { "n": 1, "median": 90, "min": 90, "max": 90, "p25": 90, "p75": 90, "mean": 90 } }, "revised privacy notice": { "day": { "n": 2, "median": 60, "min": 60, "max": 60, "p25": null, "p75": null, "mean": 60 } }, "act on an access request": { "day": { "n": 1, "median": 30, "min": 30, "max": 30, "p25": 30, "p75": 30, "mean": 30 } }, "act on an amendment request": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "opt-out request": { "day": { "n": 1, "median": 30, "min": 30, "max": 30, "p25": 30, "p75": 30, "mean": 30 } }, "do-not-call list version": { "day": { "n": 1, "median": 31, "min": 31, "max": 31, "p25": 31, "p75": 31, "mean": 31 } } } }, "rows": [ { "source": "eCFR 45 CFR part 164 - security and privacy", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "requirement": "breach notice posting" }, "retrieved_at": "2026-10-17", "quote": "(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and", "source_class": "primary-government", "text_sha256": "5f8b30429c0b18c1d29c308ac715efe4d023e9e1089a61f4410e448e7c3fdf67" }, { "source": "eCFR 45 CFR part 164 - security and privacy", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "requirement": "breach toll-free line" }, "retrieved_at": "2026-10-17", "quote": "(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.", "source_class": "primary-government", "text_sha256": "5f8b30429c0b18c1d29c308ac715efe4d023e9e1089a61f4410e448e7c3fdf67" }, { "source": "eCFR 45 CFR part 164 - security and privacy", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "requirement": "revised privacy notice" }, "retrieved_at": "2026-10-17", "quote": "(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.", "source_class": "primary-government", "text_sha256": "5f8b30429c0b18c1d29c308ac715efe4d023e9e1089a61f4410e448e7c3fdf67" }, { "source": "eCFR 45 CFR part 164 - security and privacy", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "requirement": "act on an access request" }, "retrieved_at": "2026-10-17", "quote": "(i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows.", "source_class": "primary-government", "text_sha256": "5f8b30429c0b18c1d29c308ac715efe4d023e9e1089a61f4410e448e7c3fdf67" }, { "source": "eCFR 45 CFR part 164 - security and privacy", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "requirement": "act on an amendment request" }, "retrieved_at": "2026-10-17", "quote": "(i) The covered entity must act on the individual's request for an amendment no later than 60 days after receipt of such a request, as follows.", "source_class": "primary-government", "text_sha256": "5f8b30429c0b18c1d29c308ac715efe4d023e9e1089a61f4410e448e7c3fdf67" }, { "source": "eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation", "url": "https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "requirement": "opt-out request" }, "retrieved_at": "2026-10-17", "quote": "(B) The notice states that the recipient may make a request to the sender of the advertisement not to send any future advertisements to a telephone facsimile machine or machines and that failure to comply, within 30 days, with such a request meeting the requirements under paragraph (a)(4)(v) of this section is unlawful;", "source_class": "primary-government", "text_sha256": "cf02676b2872fa8c08b00e8e4d93769a8c66edaa367ce76cb63a51141fe5b705" }, { "source": "eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation", "url": "https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200", "figure": "31 days", "value": 31, "unit": "day", "vat": null, "axis": { "requirement": "do-not-call list version" }, "retrieved_at": "2026-10-17", "quote": "It uses a process to prevent telephone solicitations to any telephone number on any list established pursuant to the do-not-call rules, employing a version of the national do-not-call registry obtained from the administrator of the registry no more than 31 days prior to the date any call is made, and maintains records documenting this process.", "source_class": "primary-government", "text_sha256": "cf02676b2872fa8c08b00e8e4d93769a8c66edaa367ce76cb63a51141fe5b705" }, { "source": "eCFR 45 CFR 164.520 - notice of privacy practices", "url": "https://www.ecfr.gov/current/title-45/section-164.520", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "requirement": "revised privacy notice" }, "retrieved_at": "2026-10-17", "quote": "(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.", "source_class": "primary-government", "text_sha256": "80da9a71497183290a95af0362a327773a8b5b9fd067560b4d2a2f7820df0600" } ], "not_published": [ { "source": "HHS - HIPAA for professionals, the Privacy Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/index.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS - model notices of privacy practices", "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS - sample business associate agreement provisions", "url": "https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS - HIPAA Security Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "FTC - Telemarketing Sales Rule", "url": "https://www.ftc.gov/legal-library/browse/rules/telemarketing-sales-rule", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "ESIGN Act, Public Law 106-229", "url": "https://www.govinfo.gov/content/pkg/PLAW-106publ229/html/PLAW-106publ229.htm", "retrieved_at": "2026-09-12", "reason": "every candidate on the page was refused" }, { "source": "FCC - stop unwanted robocalls and texts", "url": "https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "ABA - Model Rules of Professional Conduct, conflict of interest (current clients)", "url": "https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_7_conflict_of_interest_current_clients/", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "ABA - Model Rule 1.18, duties to prospective clients", "url": "https://www.americanbar.org/groups/professional_responsibility/policy/ethics_2000_commission/e2k_rule118rem/", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO - lawful basis: consent", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/consent/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "eCFR 45 CFR 164.502 - uses and disclosures, general rules", "url": "https://www.ecfr.gov/current/title-45/section-164.502", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/index.html", "label": "HHS - HIPAA for professionals, the Privacy Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164", "label": "eCFR 45 CFR part 164 - security and privacy", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html", "label": "HHS - model notices of privacy practices", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html", "label": "HHS - sample business associate agreement provisions", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "label": "HHS - HIPAA Security Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200", "label": "eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/legal-library/browse/rules/telemarketing-sales-rule", "label": "FTC - Telemarketing Sales Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.govinfo.gov/content/pkg/PLAW-106publ229/html/PLAW-106publ229.htm", "label": "ESIGN Act, Public Law 106-229", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts", "label": "FCC - stop unwanted robocalls and texts", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_7_conflict_of_interest_current_clients/", "label": "ABA - Model Rules of Professional Conduct, conflict of interest (current clients)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.americanbar.org/groups/professional_responsibility/policy/ethics_2000_commission/e2k_rule118rem/", "label": "ABA - Model Rule 1.18, duties to prospective clients", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-510.pdf", "label": "ABA Formal Opinion 510", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/consent/", "label": "ICO - lawful basis: consent", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/section-164.520", "label": "eCFR 45 CFR 164.520 - notice of privacy practices", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-45/section-164.502", "label": "eCFR 45 CFR 164.502 - uses and disclosures, general rules", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/", "label": "americanbar.org", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 3 of the 14 named sources that could be read published a usable figure; 11 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 8 figures, never sentences; 22 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per obligation x per regime: what the rule requires of an intake specifically (the notice that must be given, the consent that must be obtained and in what form, the agreement that must exist with the vendor, the record that must be kept and for how long, the screen that must be run before a matter opens), the citation, the penalty band, and the date last amended. The derivation is the CHECKLIST no regulator publishes: the union of what a single electronic intake form must satisfy when it is simultaneously a HIPAA disclosure, an e-signature, a marketing consent and, for a law firm, a Rule 1.18 exposure - and the state-by-state divergence where a bar has adopted the model rule with changes.", "embed": "

30 to 90 day

8 published figures, Intake Compliance Rules, across 3 sources, read 17 October 2026

Source: Clipboardo Intake Compliance Rules
" }