This study presents information regarding the decisions that health care privacy officers make about reporting a data breach, including factors that can affect the decision process, such as personal/organizational knowledge, prior breach status, and framed scenarios.