Notifications should be provided in plain language and can be delivered via first-class mail or email if the individual has agreed to electronic communication. The notice must include a brief description of the breach, the types of information involved, steps individuals should take to protect themselves, and what the covered entity is doing to investigate and mitigate the breach.
