You are the privacy officer of a local hospital. A well-known celebrity is brought to the emergency room on July 4. A hospital nurse who is not involved in the celebrity's care learns the celebrity has been rushed to the hospital from a news report. The news report does not say why the celebrity was taken to the hospital.

The nurse uses her credentials to access the hospital's electronic medical record and look up the celebrity. She learns the celebrity was injured when a firecracker exploded in his hand. She also learns that the celebrity's blood alcohol level was three times the legal limit.

The next day, the nurse discloses this information to two other hospital employees, neither of whom was involved in the celebrity's care. She also discloses this information to her sister, who is not a hospital employee.

The next week, a news report reveals that according to several eyewitnesses, the celebrity was injured at a party when a firecracker went off in his hand. The witnesses, who were present at the party, say the celebrity was clearly intoxicated at the time of the accident.

Did the nurse breach the celebrity's protected health information? If so, is the hospital required to notify the celebrity of the breach? Why or why not?