HITECH Act 13402a: Section 13402(a) to (c): notify every individual whose unsecured PHI was breached; breaches deemed discovered when known or reasonably knowable

A covered entity that holds, uses or discloses unsecured protected health information must, on discovering a breach of it, notify each individual whose information has been or is reasonably believed to have been accessed, acquired or disclosed. A breach is treated as discovered on the first day it is known, or by reasonable diligence should have been known, to any workforce member or agent other than the person committing it. Unsecured means not rendered unusable, unreadable or indecipherable by the technologies the Secretary specifies in guidance (encryption and destruction), so secured information is outside the duty.