For non-HIPAA covered entities, there will be a breach notification requirement for unauthorized uses and disclosures of Part 2 data. Part 2 programs will be required to notify the patient and the ...