Personal laptop, possibly containing data on 5M patients, stolen from HHS facility

Just curious, but if the Department of Health and Human Services (HHS) commits or experiences a HIPAA-related data breach, do they have to call themselves and self-report?  In all seriousness, this is a tremendous amount of PHI lost.

http://www.scmagazine.com/personal-laptop-possibly-containing-data-on-5m-patients-stolen-from-hhs-facility/article/487917/

#breach #HHS #HIPAA