Common use of Notification Obligations; Mitigation Clause in Contracts

Notification Obligations; Mitigation. During the term of this BA Agreement, Business Associate shall notify Covered Entity within five (5) days (or such shorter time period as required by applicable State law) after the discovery of any use and/or disclosure of PHI not permitted by this BA Agreement, a Breach of Unsecured PHI, or any material Security Incident and shall provide Covered Entity with information regarding the improper use and/or disclosure, Breach or Security Incident as required by law. Business Associate shall take corrective action to mitigate and cure, if possible, any harmful effect that is known to Business Associate of an improper use and/or disclosure of PHI, Breach, or Security Incident. Business Associate shall cooperate with Covered Entity regarding any Breach notification to third parties, and shall reimburse Covered Entity for any reasonable notification costs incurred by Covered Entity in complying with the applicable requirements of HIPAA resulting from a Breach of Unsecured PHI by Business Associate. Business Associate shall be deemed to discover a Breach of Unsecured PHI as of the first day on which such Breach is known, or should have been known, by Business Associate.