https://www.johner-institut.de/blog/regulatory-affairs/health-breach-notification-rule/