The three exceptions to the definition of a breach are situations where the impermissible use or disclosure of PHI does not require breach notification. These exceptions include: (1) unintentional access or acquisition of PHI by an authorized workforce member; (2) inadvertent disclosure of PHI between authorized individuals within the same covered entity; and (3) instances where the unauthorized person who obtained PHI would not be able to retain the information.