When lacking good data about a breach, what type of notice must be used?

The correct answer is that when lacking good data about a breach, substitute notice must be used. Substitute notice is a method employed when it is not feasible to provide direct notifications to the individuals whose protected health information may have been compromised. This situation often arises when the identities of affected individuals are unknown or when there are significant difficulties in reaching them.

Substitute notice typically includes posting a notice on the covered entity's website and may involve notifying prominent media outlets in the area where the individuals are believed to reside. This method ensures that the information about the breach reaches a broader audience, thereby fulfilling legal obligations while acknowledging the limitations in immediate, detailed communication.

This approach differs from other notification types. For instance, an emergency notice would be geared towards urgent situations where rapid communication is necessary, which doesn't apply here due to the lack of good data. Comprehensive notice implies that detailed information is available, which is not the case when good data is lacking. Delayed notification might imply that notice is postponed indefinitely, rather than using alternate methods to ensure awareness among affected individuals. Therefore, using substitute notice is the appropriate action when good data about a breach is unavailable.