Understanding the policies and procedures in place to notify patients and others when data breaches happen.