It’s important that employees or companies report these violations to their designated privacy officer. The privacy officer will then report the cases to the government as needed at HHS.gov. Likely an investigation will ensue, including a risk assessment about the type of information breached.