I'm not familiar with any law or regulation that requires this breach to be publicly disclosed. It's certainly not covered by California SB 1386, which requires personally identifiable financial information to be exposed to trigger a notification. So kudos to the NHLBI for doing the right thing, and alerting participants who may be affected.
However, it's the promise of future security enhancements that rings hollow. It sounds like the text in so many other breach notifications that have made the news in recent years:
We want to assure the participants in this and every other NHLBI study that we are taking several steps to increase data security and ensure that similar incidents do not occur in the future.
And it continues:
The NHLBI is conducting proper follow-up procedures with those responsible for this incident and has taken several steps to increase data security and protect the privacy of current and future study participants. First, we are ensuring that all NHLBI laptop computers are encrypted, as required by policies of the DHHS and the Office of Management and Budget. Laptop computers in the possession of NHLBI research staff are being inspected by NIH CIT information security personnel to ensure that appropriate encryption software is installed.
The interesting question here is one about organizations and risk. What is it about risk that makes organizations only take these sorts of security-conscious steps after there's a breach?