A back-up tape is lost while being transported to off-site storage and has unsecured patient records on it. You service a tri-state area with thousands of patients residing in each of the states. In order to meet the requirements for breach notification, you have notified the individuals and the major media in the appropriate areas within the delineated timeframe. In addition, you have posted information on your website. Have you done everything required under ARRA/HITECH when such a breach is discovered?