"If a plan participant???s name, Social Security number, address, or other identifying information were to be compromised while held by an insurer or TPA, such disclosure would constitute a breach for purposes of the Health Information Technology for Economic and Clinical Health (HITECH) Act and HIPAA. In that situation, state-level breach notification laws also are likely to be implicated." . . . . .