The U.S. Department of Health and Human Services (HHS) has published an interim final rule that sets forth when and how psychologists and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) must give notice to patients and HHS if they discover that protected health information has been breached.