Hippa security breach notified after breach discovered?