Under 45 CFR 164.402 a "breach" is
the acquisition, access, use, or disclosure of protected health
information in a manner not permitted under subpart E of this part
which compromises the security or privacy of the protected health
information.
Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is not a breach.
If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says
A covered entity shall be deemed to have knowledge of a breach if such
breach is known, or by exercising reasonable diligence would have been
known, to any person, other than the person committing the breach, who
is a workforce member or agent of the covered entity
So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also file a complaint with HHS.