Duty to Report Violations. Subcontractor agrees to immediately report to Customer any use or disclosure of PHI by Subcontractor not provided for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. Subcontractor agrees to report to Customer any Security Incident of which it becomes aware. If a breach occurs, Subcontractor also agrees to cooperate and assist in any steps taken by Customer to mitigate and address the breach. As soon as reasonably possible and in all cases, within five (5) working days of the first day on which any employee, officer, or agent of Subcontractor either knows or, by exercising reasonable due diligence, would have known that a Breach of Unsecured PHI has occurred, Subcontractor shall notify Customer of such Breach. The notification shall include the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Subcontractor to have been, accessed, acquired, used, or disclosed during such Breach. The notification shall also include: (1) a brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known; (2) a description of the types of Unsecured PHI that were involved in the Breach (such as full name, social security number, date of birth, home address, account number, or disability code); (3) recommended steps that Individuals should take to protect themselves from potential harm resulting from the Breach; and (4) a brief description of what Subcontractor is doing to investigate the Breach, to mitigate harm to Individuals, and to protect against any further Breaches. Subcontractor shall maintain evidence to demonstrate that any required notification under this paragraph was made unless Subcontractor determines that a delayed notification applies.
Duty to Report Violations. Business Associate shall report to Covered Entity any Use or Disclosure of PHI not provided for by the HIPAA Rules or this Addendum of which it becomes aware, including breaches of Unsecured PHI as required at 45 CFR 164.410, and any Security Incident of which it becomes aware.
Duty to Report Violations. Distribution Entity agree to report to Insurance Company any use or disclosure of the Protected Health Information not provided for by the Agreement of which it becomes aware. Sales Representatives - Distribution Entity agree to ensure that any sales representative, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Distribution Entity on behalf of Insurance Company agrees to the same restrictions and conditions that apply through the Agreement to Distribution Entity with respect to such information.
Duty to Report Violations. If at any time any representation or warranty of Consultant set forth in this Section 6 are no longer accurate, Consultant will immediately notify Arbutus of such fact. In addition to other rights or remedies under this Agreement or at law, Xxxxxxx may terminate this Agreement if Consultant breaches any such representations or warranties or if Xxxxxxx learns that improper payments are being or have been made to or by Consultant or any individual or entity acting on its or their behalf. In case of such termination, no further payment will be due to Consultant, and Consultant will refund to Arbutus all payments made under this Agreement if requested by Arbutus, which shall not limit any other claims or rights that Arbutus may have against Consultant.
Duty to Report Violations. Business Associate agrees to promptly report to Customer any use or disclosure of PHI by Business Associate not provided for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. Business Associate agrees to report to Customer any Security Incident of which it becomes aware. If a breach occurs, Business Associate also agrees to cooperate and assist in any steps taken by Customer to mitigate and address the breach. As soon as reasonably possible and in all cases, within ten (10) business days of the first day on which any employee, officer, or agent of Business Associate either knows or, by exercising reasonable due diligence, would have known that a Breach of Unsecured PHI has occurred, Business Associate shall notify Customer of such Breach. The notification shall include the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during such Breach. The notification shall also include: (1) a brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known; (2) recommended steps that Individuals should take to protect themselves from potential harm resulting from the Breach; and (3) a brief description of what Business Associate is doing to investigate the Breach, to mitigate harm to Individuals, and to protect against any further Breaches. Business Associate shall maintain evidence to demonstrate that any required notification under this paragraph was made unless Business Associate determines that a delayed notification applies.
Duty to Report Violations. Subcontractor agrees to report to Business Associate in writing any use or disclosure of PHI not provided for by the Privacy Rule or this Agreement of which it becomes aware, within 15 working days of the discovery of the unauthorized use or disclosure.
Duty to Report Violations. To the extent Plan Sponsor and/or an Authorized Employee becomes aware of any use or disclosure that is inconsistent with the uses or disclosures permitted under this Article XII, Plan Sponsor and/or the Authorized Employee will report such inconsistent uses or disclosures to Covered Entity.
Duty to Report Violations. CCNC agrees to report to Covered Entity any use or Disclosure of PHI by CCNC not allowed for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. CCNC agrees to report to Covered Entity any Security Incident (as defined by 45 C.F.R. §164.304) involving Electronic PHI. The Parties agree that this section satisfies any notice requirements by CCNC to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” include activities such as “pings” on CCNC’s firewall(s), port scans, unsuccessful log on attempts, denial-of-service attacks that do not result in a server being taken offline; or
Duty to Report Violations. Subcontractor agrees to immediately report to Customer any use or disclosure of PHI by Subcontractor not provided for by the Privacy Rule, the Security Rule or this BAA of which it becomes aware. Subcontractor agrees to report to Customer any Security Incident of which it becomes aware. If a breach occurs, Subcontractor also agrees to cooperate and assist in any steps taken by Customer to mitigate and address the breach. As soon as reasonably possible and in all cases, within five (5) working days of the first day on which any employee, officer, or agent of Subcontractor either knows or, by exercising reasonable due diligence, would have known that a Breach of Unsecured PHI has occurred, Subcontractor shall notify Customer of such Breach. The notification shall include the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Subcontractor to have been, accessed, acquired, used, or disclosed during such Breach. The notification shall also include: (1) a brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known;
