Healthcare data breach reporting requirements: who must be notified, when deadlines apply, and how HIPAA, FTC, and state rules overlap for response teams.