Covered entities must provide individual notice to people affected by a breach without unreasonable delay (within 60 days unless another state rule applies). This notification should contain information on what happened, what personal information was exposed, and how the covered entity is working to mitigate harm. You must also provide substitute notice to people you do not have a current address for. This is often a notice on your website.