You work in a hospital. You get a telephone call from an attorney’s office informing you that their computer system has been compromised and they assume the hackers have gained access to all their electronic files. You know that this attorney has represented the hospital in several medical malpractice claims in the past. You conduct an investigation on what was sent to the attorney electronically and see that multiple electronic files containing patient PHI had been e-mailed to the attorney’s office in the past. At no point was the hospital’s e-mail or electronic medical record system compromised.
Would the hospital be required to perform any type of breech notification based on this incident?