Individuals affected must be notified by email or by substitute notice of discovery of the breach.
Individual notifications must be provided without unreasonable delay and in no case later than 60 days.
Must be given in event of a breach affecting more than 500 residents of a state or jurisdiction in addition to notifying the affected individuals.
Notice to the Secretary HHS/OCR
The breach notification by the covered entity will differ based on whether the breach affected 500 or more individuals or fewer than 500 individuals.