Because the breach involved more than 500 people living in the same area, three sets of people have to be notified, these are: the individuals concerned, the United State department of health and human services and a prominent media outlet in the state of Tennessee.
