A HIPAA breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. Covered entities must provide notification of the breach to affected individuals, the Secretary of HHS, and, in certain circumstances, to the media.