2. If an information technology auditor working on behalf of a hospital with a valid business associate agreement inadvertently loses the unencrypted medical billing records of 300 individuals, what type of notification is NOT required? A. The hospital must provide notice to prominent media outlets serving the state or jurisdiction. B. The hospital or auditor must provide individual notice to the affected individuals. C. The hospital must notify the Secretary of the Department of Health and Human Services (HHS). D. The auditor must notify the hospital following discovery of the breach.

2. If an information technology auditor working on behalf of a hospital with a valid business associate agreement inadvertently loses the unencrypted medical billing records of 300 individuals, what type of notification is NOT required? A. The hospital must provide notice to prominent media outlets serving the state or jurisdiction. B. The hospital or auditor must provide individual notice to the affected individuals. C. The hospital must notify the Secretary of the Department of Health and Human Services (HHS). D. The auditor must notify the hospital following discovery of the breach.