Common use of BREACH DISCOVERY AND NOTIFICATION Clause in Contracts

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 twenty four (24) hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 25 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 26 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 27 law enforcement official pursuant to 45 CFR § 164.412. 26 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 30 known to CONTRACTOR. 29 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 36 notification within 24 twenty four (24) hours of the oral notification. 35 37 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 25 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 26 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 27 law enforcement official pursuant to 45 CFR § 164.412. 26 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 30 known to CONTRACTOR. 29 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 36 notification within 24 hours of the oral notification. 35 37 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 1 b. Any other information that COUNTY is required to include in the notification to 2 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 3 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 4 period set forth in 45 CFR § 164.410 (b) has elapsed, including:

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 twenty-four (24) hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 15 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 16 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 17 law enforcement official pursuant to 45 CFR § 164.412. 26 18 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 19 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 20 known to CONTRACTOR. 29 21 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 22 known, or by exercising reasonable diligence would have been known, to any person who is an 23 employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 24 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 25 Privacy Officer. CONTRACTOR’s s notification may be oral, but shall be followed by written 34 26 notification within 24 twenty-four (24) hours of the oral notification. 35 27 3. CONTRACTOR’s s notification shall include, to the extent possible: 36 28 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 29 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 30 b. Any other information that COUNTY is required to include in the notification to 31 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 32 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 33 period set forth in 45 CFR § 164.410 (b) has elapsed, including:

BREACH DISCOVERY AND NOTIFICATION. 23 20 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 21 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 22 law enforcement official pursuant to 45 CFR § 164.412. 26 23 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 24 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 25 known to CONTRACTOR. 29 26 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 27 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 28 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 29 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 30 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 31 notification within 24 twenty-four (24) hours of the oral notification. 35 32 3. CONTRACTOR’s notification shall include, to the extent possible: 36 33 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 34 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 35 b. Any other information that COUNTY is required to include in the notification to 36 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 37 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day period 1 set forth in 45 CFR § 164.410 (b) has elapsed, including:

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a x 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 twenty-four (24) hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 1 b. Any other information that COUNTY is required to include in the notification to 2 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 3 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 4 period set forth in 45 CFR § 164.410 (b) has elapsed, including:

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a x 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties Parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours five (5) business days of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 17 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 18 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 19 law enforcement official pursuant to 45 CFR § 164.412. 26 20 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 21 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 22 known to CONTRACTOR. 29 23 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 24 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 25 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 26 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 27 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 28 notification within 24 twenty-four (24) hours of the oral notification. 35 29 3. CONTRACTOR’s notification shall include, to the extent possible: 36 30 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 31 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 32 b. Any other information that COUNTY is required to include in the notification to 33 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 34 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 35 period set forth in 45 CFR § 164.410 (b) has elapsed, including:

BREACH DISCOVERY AND NOTIFICATION. 23 1. 5.01 Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY CITY of such Breach, however however, both parties may agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § §164.412. 26 a. 5.01.1 A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. 5.01.2 CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have been known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by the federal common law of agency. 32 2. 5.02 CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CITY DEH Executive Director or other designee. 5.02.1 CONTRACTOR’s 'S initial notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. 5.03 CONTRACTOR’s 'S notification shall include, to the extent possible: 36 a. 5.03.l The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 twenty-four (24) hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 1 b. Any other information that COUNTY is required to include in the notification to 2 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 3 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 4 period set forth in 45 CFR § 164.410 (b) has elapsed, including: