Follow the IRAC method, and in narrative form, thoroughly answer the 3 questions as it applies to the highlighted scenario below:

1. Was there was a privacy breach?
2. Is the breach reportable?
3. If applicable, who should the breach should be reported to?

An employee at health facility D searched the facility's encrypted Electronic Health Record (EHR) for patient X's medical record using patient X's first and last names. The employee is a nurse in the pediatric department of health facility C. The patient is a geriatric patient and is not under the care of the nurse. The employee accessed patient X's entire medical history and disclosed the patient's medical history on social media. Health facility D is not a licensed facility.