(a)(1)(B) with respect to a breach shall be provided in the following form: (1) Written notification by first-class mail to the individual (or the next of kin of the individual if the individual is deceased) at the last known address of the individual or the next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. The notification may be provided in one or more mailings as information is available. (2) In the case in which there is insufficient or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes direct written or (if specified by the individual) electronic notification to the individual, a substitute form of notification shall be provided, including, in the case that there are 500 or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting for a minimum of 30 days on the homepage of the website of the covered entity involved. Such a website posting shall include a toll-free telephone number that an individual can call to learn whether or not the individual’s unsecured sensitive personally identifiable information is possibly included in the breach. (3) In any case considered by the covered entity involved to require urgency because of possible imminent misuse of unsecured sensitive personally identifiable information, the covered entity, in addition to notification as required by paragraphs (1) and (2), may provide information to individuals by telephone or other means, as appropriate. (d) Content of notification Each notification of a breach under subsection (a)(1) shall include, to the extent possible, the following: (1) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known. (2) A description of the types of unsecured sensitive personally identifiable information that were involved in the breach. (3) The steps individuals should take to protect themselves from