What needs to happen for the disclosure of personally identifiable health information to qualify as a breach?

A) The disclosure results unintentionally from the actions of covered entity's employee.
B) The disclosure poses a significant risk to the affected person.
C) The disclosure results unintentionally during an exchange of information at a covered entity.
D) The information involved was something the affected person could not have kept private.

B