"Health plans, health care providers, health care clearinghouses ('covered entities') and their business associates should confirm their existing policies, practices and training for communicating with the media and others comply with the Privacy Rule requirements of [the HIPAA Privacy Rule] in light of a Resolution Agreement with Shasta Regional Medical Center (SRMC) announced [on June 14, 2013].... [E]fforts to respond to press or media reports, patient or other complaints, physician or employee disputes, high profile accidents, or other events that may involve communications not typically run by privacy officers can create big exposures. While the Resolution Agreement targets a health care provider, the lessons are equally applicable to health plans and health care clearinghouses[.]"