This Ropes & Gray memorandum discusses an interim rule released by the Department of Health and Human Services (HHS) implementing new breach notification requirements for unsecured protected health information (PHI).