OBLIGATIONS OF THE PARTIES WITH RESPECT TO PHI; OBLIGATIONS RELATING TO MCD Sample Clauses

OBLIGATIONS OF THE PARTIES WITH RESPECT TO PHI; OBLIGATIONS RELATING TO MCD. 2.1 Obligations of Subcontractor. With regard to its use and/or disclosure of PHI, Subcontractor agrees to: a. Not use or disclose the PHI other than as permitted or required by this Agreement or as required by applicable law, rule or regulation, or by accrediting or credentialing organization to whom Regional ILC is required to disclose such information or as otherwise permitted under the Privacy and Security Rules. b. Implement and use appropriate safeguards to prevent the use or disclosure of the PHI other than as provided for by this Agreement. Without limiting the generality of the foregoing sentence, Subcontractor will: (i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI as required by the Privacy and Security Rules; (ii) Ensure that any agent, including an additional subcontractor, to whom Subcontractor provides Electronic PHI agrees to implement reasonable and appropriate safeguards to protect Electronic PHI; and (iii) Promptly (but in no event later than 10 days after discovery (as defined in 45 C.F.R. § 164.410(a)(2)) thereof) report to Regional ILC any Security Incident of which Subcontractor becomes aware. Any notice of a Security Incident shall include the identification of each Individual whose Protected Health Information has been, or is reasonably believed by Subcontractor to have been, accessed, acquired, or disclosed during such Security Incident as well as any other relevant information regarding the Security Incident, in each case to the extent such information is available to Subcontractor and promptly after (but in no event later than 10 days after discovery (as defined in 45 C.F.R. § 164.410(a)(2)) thereof) such information becomes known to Subcontractor. c. Promptly report to Regional ILC, and mitigate, to the extent practicable, any harmful effect that is known to Subcontractor of any use or disclosure of PHI by Subcontractor in violation of the requirements of this Agreement and/or any Security Incident or Breach, and take steps to avoid any further similar violating uses or disclosures and/or Security Incidents or Breaches; provided, however, that the Parties acknowledge and agree that this Section constitutes notice by Subcontractor to Regional ILC of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Regional ILC by Subcontractor shall ...