Common use of BREACH DISCOVERY AND NOTIFICATION Clause in Contracts

BREACH DISCOVERY AND NOTIFICATION. 37 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 1 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 2 law enforcement official pursuant to 45 CFR § 164.412. 3 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 4 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 5 known to CONTRACTOR. 6 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 7 known, or by exercising reasonable diligence would have known, to any person who is an employee, 8 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 9 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 10 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 11 notification within twenty four (24) hours of the oral notification. 12 // 13 a. CONTRACTOR’S notification may be oral, but shall be followed by written 14 notification within 24 hours of the oral notification. 15 3. CONTRACTOR’s notification shall include, to the extent possible: 16 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 17 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 18 b. Any other information that COUNTY is required to include in the notification to 19 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 20 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 21 period set forth in 45 CFR § 164.410 (b) has elapsed, including: 22 (1) A brief description of what happened, including the date of the Breach and the date 23 of the discovery of the Breach, if known;

BREACH DISCOVERY AND NOTIFICATION. 37 25 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 1 26 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 2 27 law enforcement official pursuant to 45 CFR § 164.412. 3 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 4 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 5 30 known to CONTRACTOR. 6 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 7 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 8 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 9 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 10 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 11 36 notification within twenty four (24) hours of the oral notification. 12 //37 // DocuSign Envelope ID: 699FFF44-9B19-4784-9DB4-4408BB3EF09D 13 a. CONTRACTOR’S notification may be oral, but shall be followed by written 14 notification within 24 hours of the oral notification. 15 1 3. CONTRACTOR’s notification shall include, to the extent possible: 16 2 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 17 3 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 18 4 b. Any other information that COUNTY is required to include in the notification to 19 5 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 20 6 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 21 period 7 set forth in 45 CFR § 164.410 (b) has elapsed, including: 22 (1) A brief description of what happened, including the date of the Breach and the date 23 of the discovery of the Breach, if known;

BREACH DISCOVERY AND NOTIFICATION. 37 9 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 1 10 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 2 11 law enforcement official pursuant to 45 CFR § 164.412. 3 12 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 4 13 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 5 14 known to CONTRACTOR. 6 15 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 7 16 known, or by exercising reasonable diligence would have known, to any person who is an employee, 8 17 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 9 18 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 10 19 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 11 20 notification within twenty four (24) hours of the oral notification. 12 // 13 a. CONTRACTOR’S notification may be oral, but shall be followed by written 14 notification within 24 hours of the oral notification. 15 21 3. CONTRACTOR’s notification shall include, to the extent possible: 16 22 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 17 23 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 18 24 b. Any other information that COUNTY is required to include in the notification to 19 25 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 20 26 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 21 27 period set forth in 45 CFR § 164.410 (b) has elapsed, including: 22 (1) A brief description of what happened, including the date of the Breach and the date 23 of the discovery of the Breach, if known;

BREACH DISCOVERY AND NOTIFICATION. 37 26 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 1 27 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 2 28 law enforcement official pursuant to 45 CFR § 164.412. 3 29 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 4 30 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 5 31 known to CONTRACTOR. 6 32 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 7 33 known, or by exercising reasonable diligence would have known, to any person who is an employee, 8 34 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 9 35 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 10 36 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 11 notification within twenty four (24) hours of the oral notification. 12 // 13 a. CONTRACTOR’S notification may be oral, but shall be followed by written 14 37 notification within 24 hours of the oral notification.. 11 of 15 EXHIBIT B X:\CONTRACTS - 2019 -\2019-2020\PH\ASF15 HIV HOUSING HPP-FY 19-20 JC.DOC ASF15PHKK20 AIDS SERVICE FOUNDATION ORANGE COUNTY RADIANT HEALTH CENTERS MA 042-17010845 HCA ASR 19-001190 Page 60 of 68 15 1 3. CONTRACTOR’s notification shall include, to the extent possible: 16 2 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 17 3 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 18 4 b. Any other information that COUNTY is required to include in the notification to 19 5 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 20 6 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 21 period 7 set forth in 45 CFR § 164.410 (b) has elapsed, including: 22 (8 1) A brief description of what happened, including the date of the Breach and the date 23 9 of the discovery of the Breach, if known; 10 2) A description of the types of Unsecured PHI that were involved in the Breach (such 11 as whether full name, social security number, date of birth, home address, account number, diagnosis, 12 disability code, or other types of information were involved); 13 3) Any steps Individuals should take to protect themselves from potential harm 14 resulting from the Breach; 15 4) A brief description of what CONTRACTOR is doing to investigate the Breach, to 16 mitigate harm to Individuals, and to protect against any future Breaches; and 17 5) Contact procedures for Individuals to ask questions or learn additional information, 18 which shall include a toll-free telephone number, an e-mail address, Web site, or postal address. 19 4. COUNTY may require CONTRACTOR to provide notice to the Individual as required in 20 45 CFR § 164.404, if it is reasonable to do so under the circumstances, at the sole discretion of the 21 COUNTY. 22 5. In the event that CONTRACTOR is responsible for a Breach of Unsecured PHI in violation 23 of the HIPAA Privacy Rule, CONTRACTOR shall have the burden of demonstrating that 24 CONTRACTOR made all notifications to COUNTY consistent with this Paragraph F and as required by 25 the Breach notification regulations, or, in the alternative, that the acquisition, access, use, or disclosure 26 of PHI did not constitute a Breach. 27 6. CONTRACTOR shall maintain documentation of all required notifications of a Breach or 28 its risk assessment under 45 CFR § 164.402 to demonstrate that a Breach did not occur. 29 7. CONTRACTOR shall provide to COUNTY all specific and pertinent information about the 30 Breach, including the information listed in Section E.3.b.(1)-(5) above, if not yet provided, to permit 31 COUNTY to meet its notification obligations under Subpart D of 45 CFR Part 164 as soon as 32 practicable, but in no event later than fifteen (15) calendar days after CONTRACTOR’s initial report of 33 the Breach to COUNTY pursuant to Subparagraph F.2 above. 34 8. CONTRACTOR shall continue to provide all additional pertinent information about the 35 Breach to COUNTY as it may become available, in reporting increments of five (5) business days after 36 the last report to COUNTY. CONTRACTOR shall also respond in good faith to any reasonable 37 // 12 of 15 EXHIBIT B X:\CONTRACTS - 2019 -\2019-2020\PH\ASF15 HIV HOUSING HPP-FY 19-20 JC.DOC ASF15PHKK20 AIDS SERVICE FOUNDATION ORANGE COUNTY RADIANT HEALTH CENTERS MA 042-17010845 HCA ASR 19-001190 Page 61 of 68 1 requests for further information, or follow-up information after report to COUNTY, when such request 2 is made by COUNTY. 3 9. If the Breach is the fault of CONTRACTOR, CONTRACTOR shall bear all expense or 4 other costs associated with the Breach and shall reimburse COUNTY for all expenses COUNTY incurs 5 in addressing the Breach and consequences thereof, including costs of investigation, notification, 6 remediation, documentation or other costs associated with addressing the Breach.