Business associates who access information by good faith, unintentional means and do not further disclose information

Unintentional, good faith access by employees of covered entities if the information was not further disclosed

If the information impacted less than 500 people within a single demographic area

Inadvertent disclosure made individual to individual within a covered entity who is authorized to access protected health information