Extract to table

If the covered entity cannot demonstrate a low probability of compromise, the impermissible use or disclosure must be treated as a reportable breach and notification obligations are triggered

The notification must be provided without unreasonable delay and in no case later than 60 calendar days from the date of discovery of the breach

404(b) is a maximum outer limit; the operative standard is that notification must be provided "without unreasonable delay

404(c)) The individual breach notification must include, to the extent possible, the following elements as set forth in 45 C

docx) and must incorporate all of the above content elements

In either case, the notice must include a toll-free telephone number that remains active for at least 90 days