tinely following security breaches and to comply with certain State breach notification laws???;13 andIn assessing its first enumerated risk assessment factor (the nature of the PHI used or disclosed), the OCR states: ???to assess this factor, entities should consider the type of protected health information involved in the impermissible use or disclosure, such as whether the disclosure involved i