Describe HIPAA breach notification requirements, including who must be notified and by when.

• A. Only the media must be notified.
• B. Affected individuals must be notified; the Secretary of HHS must be notified; in breaches affecting 500+ individuals, the media may need notice; notification generally within 60 days of discovery; business associates must notify the covered entity that must then notify individuals.
• C. No notification required for breaches.
• D. Only affected individuals must be notified; no timeline.

Answer: (B)