Common use of Duty to Report Violations Clause in Contracts

Duty to Report Violations. Subcontractor agrees to immediately report to Customer any use or disclosure of PHI by Subcontractor not provided for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. Subcontractor agrees to report to Customer any Security Incident of which it becomes aware. If a breach occurs, Subcontractor also agrees to cooperate and assist in any steps taken by Customer to mitigate and address the breach. As soon as reasonably possible and in all cases, within five (5) working days of the first day on which any employee, officer, or agent of Subcontractor either knows or, by exercising reasonable due diligence, would have known that a Breach of Unsecured PHI has occurred, Subcontractor shall notify Customer of such Breach. The notification shall include the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Subcontractor to have been, accessed, acquired, used, or disclosed during such Breach. The notification shall also include: (1) a brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known; (2) a description of the types of Unsecured PHI that were involved in the Breach (such as full name, social security number, date of birth, home address, account number, or disability code); (3) recommended steps that Individuals should take to protect themselves from potential harm resulting from the Breach; and (4) a brief description of what Subcontractor is doing to investigate the Breach, to mitigate harm to Individuals, and to protect against any further Breaches. Subcontractor shall maintain evidence to demonstrate that any required notification under this paragraph was made unless Subcontractor determines that a delayed notification applies.

Duty to Report Violations. Subcontractor Business Associate agrees to immediately promptly report to Customer any use or disclosure of PHI by Subcontractor Business Associate not provided for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. Subcontractor Business Associate agrees to report to Customer any Security Incident of which it becomes aware. If a breach occurs, Subcontractor Business Associate also agrees to cooperate and assist in any steps taken by Customer to mitigate and address the breach. As soon as reasonably possible and in all cases, within five ten (510) working business days of the first day on which any employee, officer, or agent of Subcontractor Business Associate either knows or, by exercising reasonable due diligence, would have known that a Breach of Unsecured PHI has occurred, Subcontractor Business Associate shall notify Customer of such Breach. The notification shall include the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Subcontractor Business Associate to have been, accessed, acquired, used, or disclosed during such Breach. The notification shall also include: (1) a brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known; (2) a description of the types of Unsecured PHI that were involved in the Breach (such as full name, social security number, date of birth, home address, account number, or disability code); (3) recommended steps that Individuals should take to protect themselves from potential harm resulting from the Breach; and (43) a brief description of what Subcontractor Business Associate is doing to investigate the Breach, to mitigate harm to Individuals, and to protect against any further Breaches. Subcontractor Business Associate shall maintain evidence to demonstrate that any required notification under this paragraph was made unless Subcontractor Business Associate determines that a delayed notification applies.