A large healthcare system experiences a ransomware attack that encrypts EHR data. According to HIPAA Breach Notification Rule, when must affected patients be notified?
-
A
Within 24 hours of discovery
-
B
Within 60 calendar days of discovering the breach
-
C
Only if the breach is reported in local news
-
D
Notification is optional if data is recovered within 30 days