Einstein is in violation of the the HHS 60-day breach notification rule, but unlikely to face penalty.