Covered Entities are required to conduct risk assessments to identify threats to PHI and implement measures to mitigate the threat to a reasonable and acceptable level. The risk of a new recruit inadvertently disclosing PHI to a third party is an easily identifiable threat; and, if a Covered Entity fails to identify the threat or implement measures to mitigate the risk, they are in violation of HIPAA.