This depends on the outcome of a risk assessment. If the risk assessment demonstrates a low probability that unsecured PHI has been compromised due to the unauthorized access, acquisition, use, or disclosure, Covered Entities do not have to notify patients (although they may still wish to do so). In all other cases, unauthorized disclosures of unsecured PHI have to be notified to affected individuals even if only one patient is affected.