Without undue delay and no later than 60 days following the discovery of the breach, a business associate must notify the covered entity of the violation.