with respect to personal information maintained by a covered entity that such covered entity obtained from another covered entity, the covered entity experiencing such data breach or data sharing abuse shall, without undue delay and, if feasible, not later than 72 hours after becoming aware of such data breach or data sharing abuse, notify such other covered entity of such data breach or data sharing abuse, unless such data breach or data sharing abuse is unlikely to create or increase foreseeable privacy harms. A covered entity receiving notice under this subsection of a data breach or data sharing abuse shall notify any other covered entity from which the covered entity receiving notice obtained personal information involved in such data breach or data sharing abuse, in the same manner as required under the preceding sentence for the covered entity experiencing such data breach or data sharing abuse. (c) Notification of individuals (1) In general In the case of a data breach or data sharing abuse with respect to personal information maintained by a covered entity (or a data breach or data sharing abuse about which a covered entity is notified under subsection (b)), if such covered entity has a relationship with an individual whose personal information was involved or potentially involved in such data breach or data sharing abuse, such covered entity shall notify such individual of such data breach or data sharing abuse not later than 14 days after becoming aware of such data breach or data sharing abuse (or, in the case of a data breach or data sharing abuse about which a covered entity is notified under subsection (b), not later than 14 days after being so notified), if such data breach or data sharing abuse creates or increases foreseeable privacy harms. (2) Medium of notification A covered entity shall notify an individual as required by paragraph (1) through— (A) the same medium through which such individual routinely interacts with such covered entity