The U.S. Department of Health and Human Services (HHS) published an interim final rule on August 24, 2009 that sets forth when and how psychologists and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) must give notice to patients and HHS if they discover that protected health information (PHI) has been breached ??? for example, stolen or improperly acc