Final answer:
The secretary of HHS and a media outlet must be notified within 60 days of a data breach involving the PHI of 500 or more individuals.
Step-by-step explanation:
The secretary of the Department of Health and Human Services (HHS) must be contacted along with a media outlet to provide breach notification when a data breach involves the protected health information (PHI) of 500 or more individuals.
According to the Health Insurance Portability and Accountability Act (HIPAA), covered entities must promptly notify affected individuals and the secretary of HHS no later than 60 days after the discovery of the breach.
If the breach affects more than 500 residents of a particular state or jurisdiction, the covered entity must also provide notice to prominent media outlets serving that area.