In a pure mathematical attack, (i.e., lacking any other information to help break a cipher) two factors above all count: 1  Computational power available, i.e., the computing power which can be brought to bear on the problem. 2  Key size, i.e., the size of key used to encrypt a message.
OMB's guidance to agencies requires them to report each PII-related breach to DHS's U.S. Computer Emergency Readiness Team (US-CERT) within 1 hour of discovery. However, complete information from most incidents can take days or months to compile; therefore preparing a meaningful report within 1 hour can be infeasible.
The protected health information (PHI) involved in the breach included patients' names, addresses, dates of birth, social security numbers, appointments, insurance information, and dental records. The CE provided breach notification to affected individuals, HHS, and the media.