Under 164.404 the obligation is on the CE to give the breach notice. Anyone seeing the BAAs wanting to send the notice to the individuals and the media (presumably to make themselves look better?). Although there is some appeal to this, I would worry the CE is on the hook if it is screwed up.
Thoughts? What are others doing?
