In the US, isn't this exactly the sort of data that, when a bank or other entity exposes it in a "breach" (lost employee laptop), is required to be reported to

In the US, isn't this exactly the sort of data that, when a bank or other entity exposes it in a "breach" (lost employee laptop), is required to be reported to the government? My understanding of this law is common knowledge, not lawyerly and knowledgeable. Maybe if you dribble it out, on purpose, it's not considered a breach.