Breach of PHI;. 2.9.1.2 Each access, acquisition, Use, or Disclosure of PHI that is made by Business Associate, its employees, representatives, agents, or Subcontractors that is not specifically permitted by this Agreement; and
Breach of PHI;. In the case of a breach of PHI, the SELPA shall comply with the applicable provisions of 42 U.S.C. § 17932 and 45 C.F.R. part 164, subpart D, including but not limited to 45 C.F.R. part 164.410. Specifically, SELPA's shall comply with the following requirements:
Breach of PHI;. An impermissible use or disclosure of PHI is presumed to be a breach unless the MHDO concludes based on demonstrable evidence that there is a low probability that the PHI has been compromised. Any person may report, and employees, vendors, board and subcommittee members shall report, to the Executive Director of MHDO when they believe a potential breach of PHI has occurred or may occur. When a potential breach of PHI is reported or made known to the MHDO Executive Director, a risk assessment shall be conducted by the Executive Director or the Staff Delegate immediately and shall consider at least the following factors: The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; the unauthorized person who used the PHI or to whom the disclosure was made; whether the PHI was actually acquired or viewed; and, the extent to which the risk to the PHI has been mitigated. Whether and how the data was secured, including encryption. The Executive Director shall keep a report of any such investigations and make the results known to the MHDO Executive Committee within twenty-four hours of the determination. If the Executive Director determines the data were encrypted or that there was a low probability of compromise to any PHI involved or that one of the exceptions to breach notification exists (unintentional or inadvertent disclosures to employees held to same security and privacy standards and not further disclosed or good faith reason to believe unauthorized person to whom a disclosure was made could not reasonably retain the PHI), there shall be no individual notification made. If there is a breach of unencrypted data including PHI that would require notice to affected individuals if the breach occurred at a covered entity, MHDO will provide individual notification similar to notification requirements of the HIPAA Privacy Rule and HIPAA Breach Notification Rule. In the event that the MHDO Executive Director determines a data breach was caused by the MHDO requiring notification to affected individuals, the Executive Director and the Executive Committee of the MHDO Board shall notify the Joint Standing Committee of the Legislature having jurisdiction over Health and Human Services matters, and the membership of the MHDO Board within 30 business days of the breach. The notification to the Health and Human Services Committee and the MHDO Board regarding the breach will maintain the confidentiality of all indi...
Breach of PHI;. With respect to Protected Health Information ("PHI") pursuant to HIPAA and the HITECH Act, including without limitation Electronic Protected Health Information and/or Unsecured Protected Health Information, the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Agreement and/or HIPAA Privacy Regulations or HIPAA Security Regulations, which compromises the security or privacy of the PHI.
Breach of PHI;. With respect to Protected Health Information ("PHI") pursuant to HIPAA and the HITECH Act, including without limitation Electronic Protected Health Information and/or Unsecured Protected Health Information, the acquisition, access, use, or disclosure of PHI in a manner not permitted under this BAA or the Base Contract and/or HIPAA Privacy Regulations or HIPAA Security Regulations, which compromises the security or privacy of the PHI as defined in 45 CFR 164.402. With respect to PHI, “compromises the security or privacy of the PHI” means poses a significant risk of financial, reputational, or other harm to the individual. A use or disclosure of De-Identified information, date of birth, and zip code does not compromise the security or privacy of the PHI. With respect to PHI, “breach,” pursuant to HIPAA, excludes:
