Common use of Initial Notice to HHS Clause in Contracts

Initial Notice to HHS. i. The Contractor will provide initial notice to the County. The Contractor agrees to perform the following incident reporting to County. ii. Immediately upon discovery of a suspected security incident that involves data provided to Contractor by County, the Contractor will notify the County by email or telephone. iii. Within one working day of discovery, the Contractor will notify the County by email or telephone of unsecured PII, if that PII was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion, or unauthorized access, use, or disclosure of PII in violation of this Agreement, or potential loss of confidential data affecting this Agreement. Notice shall be made by contacting the County as provided in this agreement, including all information known at the time. iv. A breach shall be treated as discovered by the Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach), who is an employee, officer or other agent of the Contractor. v. Upon discovery of a breach, security incident, intrusion, or unauthorized access, use, or disclosure of PII, the Contractor shall take: A. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment; and B. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.