A covered entity must notify the Secretary if it discovers a breach of unsecured protected health information. See 45 C.F.R. § 164.408. All notifications must be submitted to the Secretary using the Web portal below.Guidance‧OCR Breach Portal‧Breach Notification Rule‧Office for Civil Rights‧Summary of The Privacy Rule‧Regulation History.