The Breach Notification Rule IS < 500, ISM = or > 500, & BACE:

The Breach Notification Rule

IS: Required notification to affected Individuals, and the Secretary < 500

ISM: Required notification to affected Individuals, the Secretary, and the Media = or > 500

Business Associate must notify Covered Entity: BACE