(3) BREACH OF HEALTH INFORMATION.—If the 
Commission receives a notification of a breach of se-
curity and determines that information included in 
such breach is individually identifiable health infor-
mation (as such term is defined in section 1171(6) of 
the Social Security Act (42 U.S.C. 1320d(6)), the 
Commission shall send a copy of such notification to 
the Secretary of Health and Human Services. 
(c) TIMELINESS OF NOTIFICATION.—All notifications 
required under subsection (a) shall be made as promptly 
as possible and without unreasonable delay following the 
discovery of a breach of security of the system and consistent 
with any measures necessary to determine the scope of the 
breach, prevent further breach or unauthorized disclosures, 
and reasonably restore the integrity of the data system. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A person 
required to provide notification to individuals 
under subsection (a)(1) shall be in compliance 
with such requirement if the person provides 
conspicuous and clearly identified notification 
by one of the following methods (provided the se-
lected method can reasonably be expected to 
reach the intended individual): 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(i) Written notification. 
(ii) Email notification, if— 
(I) the person’s primary method 
of communication with the individual 
is by email; or 
(II) the individual has consented 
to receive such notification and the no-
tification is provided in a manner that 
is consistent with the provisions per-
mitting electronic transmission of no-
tices under section 101 of the Elec-
tronic Signatures in Global Commerce 
Act (15 U.S.C. 7001). 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A), 
such notification shall include— 
(i) a description of the personal infor-
mation that was acquired by an unauthor-
ized person; 
(ii) a telephone number that the indi-
vidual may use, at no cost to such indi-
vidual, to contact the person to inquire 
about the breach of security or the informa-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
tion the person maintained about that indi-
vidual; 
(iii) notice that the individual is enti-
tled to receive, at no cost to such individual, 
consumer credit reports on a quarterly basis 
for a period of 2 years, and instructions to 
the individual on requesting such reports 
from the person; 
(iv) the toll-free contact telephone num-
bers and addresses for the major credit re-
porting agencies; and 
(v) a toll-free telephone number and 
Internet website address for the Commission 
whereby the individual may obtain infor-
mation regarding identity theft. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A person required to 
provide notification to individuals under sub-
section (a)(1) may provide substitute notification 
in lieu of the direct notification required by 
paragraph (1) if— 
(i) the person owns or possesses data in 
electronic form containing personal infor-
mation of fewer than 1,000 individuals; and 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(ii) such direct notification is not fea-
sible due to— 
(I) excessive cost to the person re-
quired to provide such notification rel-
ative to the resources of such person, as 
determined in accordance with the reg-
ulations issued by the Commission 
under paragraph (3)(A); or 
(II) lack of sufficient contact in-
formation for the individual required 
to be notified. 
(B) FORM OF SUBSTITUTE NOTICE.—Such 
substitute notification shall include— 
(i) email notification to the extent that 
the person has email addresses of individ-
uals to whom it is required to provide noti-
fication under subsection (a)(1); 
(ii) a conspicuous notice on the Inter-
net website of the person (if such person 
maintains such a website); and 
(iii) notification in print and to 
broadcast media, including major media in 
metropolitan and rural areas where the in-
dividuals whose personal information was 
acquired reside. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(C) CONTENT
OF
SUBSTITUTE
NOTICE.— 
Each form of substitute notice under this para-
graph shall include— 
(i) notice that individuals whose per-
sonal information is included in the breach 
of security are entitled to receive, at no cost 
to the individuals, consumer credit reports 
on a quarterly basis for a period of 2 years, 
and instructions on requesting such reports 
from the person; and 
(ii) a telephone number by which an 
individual can, at no cost to such indi-
vidual, learn whether that individual’s per-
sonal information is included in the breach 
of security. 
(3) FEDERAL TRADE COMMISSION REGULATIONS 
AND GUIDANCE.— 
(A) REGULATIONS.—Not later than 1year 
after the date of enactment of this Act, the Com-
mission shall, by regulations under section 553 
of title 5, United States Code, establish criteria 
for determining the circumstances under which 
substitute notification may be provided under 
paragraph (2), including criteria for deter-
mining if notification under paragraph (1) is 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS