Which of the following is NOT true about HIPAA?

HIPAA's breach notification rule requires direct notification of affected individuals (by mail/email/phone, depending on circumstances), and for very large breaches with insufficient contact information, substitute notice may include posting on the covered entity's website or notifying major media outlets — but notifying patients of a breach 'via social media' as a primary/standard method is not how HIPAA breach notification works, making this the false statement.