Should intentional or unintentional breaches of PHI be reported?