Breaches of unsecured PHI are put through a risk assessment test to determine if they must be reported, the assessment considers: