As required by section 13402(e)(4) of the HITECH Act, the HHS must post a list of breaches of unsecured protected health information affecting 500 or more individuals.