The breach notification rule under HIPAA requires covered entities and business associates to promptly notify affected individuals, the Secretary of Health and Human Services, and, in some cases, the media, in the event of a breach of unsecured protected health information (PHI). The rule mandates thorough risk assessments to determine the probability of PHI compromise and determines the necessity of notifying individuals and authorities.