Individual notice is written first-class mail to the last known address (or email if the individual prefers), with substitute notice where contact information is insufficient (a conspicuous web posting or major media notice with a toll-free number where ten or more individuals cannot be reached), and telephone or other means may be added where misuse is imminent. Where the breach involves more than 500 residents of a state or jurisdiction, prominent media outlets serving it are notified. The Secretary is notified immediately for breaches of 500 or more individuals and through an annual log for smaller breaches, and HHS publishes the list of covered entities with breaches of more than 500 individuals.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.