HIPAA covered entities (healthcare providers, health plans, and health care clearinghouses) that discovered a breach of Protected Health Information (PHI) in 2016 involving fewer than 500 individuals are required to report those breaches to the U.S. Department of Health and Human Services (HHS) by this Wednesday, March 1.