Obligations under Consumer Notification Laws. If EOHHS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, M.G.L. c. 93H or other Applicable Law as a result of the Event, the Transportation Provider shall, at EOHHS’ request, assist EOHHS in drafting such notices for EOHHS’ review and approval, and shall take such other action(s) as EOHHS may reasonably request in connection with EOHHS’ compliance with the Breach Notification Rule, M.G.L. c. 93H or other Applicable Law, but in no event shall the Transportation Provider have the authority to give any such notifications on EOHHS’ behalf unless EOHHS authorizes and directs the Transportation Provider to do so in writing.
Obligations under Consumer Notification Laws. If EOHHS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, M.G.L. c. 93H or other Applicable Law as a result of the Event, the Contractor shall, at EOHHS’ request, assist EOHHS in drafting such notices for EOHHS’ review and approval, and shall take such other action(s) as EOHHS may reasonably request in connection with EOHHS’ compliance with the Breach Notification Rule, M.G.L. c. 93H or other Applicable Law, but in no event shall the Contractor have the authority to give any such notifications on EOHHS’ behalf unless EOHHS authorizes and directs the Contractor to do so in writing. Additionally, at EOHHS’ direction, if Contractor is defined as a “Person” under M.G.L. c. 93H, §1, Contractor shall provide credit monitoring services to affected Individuals to the extent required under M.G.L. c. 93H, §3A or other Applicable Law.
Obligations under Consumer Notification Laws. If EOHHS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under 45 CFR Part 164, Subpart D, M.G.L. c. 93H or other Applicable Law as a result of the Event, the Provider shall, at EOHHS’ request, assist EOHHS in drafting such notices for EOHHS’ review and approval, and shall take such other action(s) as EOHHS may reasonably request in connection with EOHHS’ compliance with 45 CFR Part 164, Subpart D, M.G.L. c. 93H or other Applicable Law, but in no event shall the Provider have the authority to give any such notifications on EOHHS’ behalf unless EOHHS authorizes and directs the Provider to do so in writing. The Provider shall reimburse EOHHS for costs incurred by EOHHS associated with any such notifications to the extent that such costs are due to: (a) the Provider’s failure to meet its responsibilities under, or in violation of, any provision of the Contract (including this Appendix); (b) the Provider’s violation of Applicable Law; (c) the Provider’s negligence; (d) the Provider’s failure to protect data under its control with encryption or other security measures that constitute an explicit safe-harbor or exception to any requirement to give notice under Applicable Law; or (e) any activity or omission of the Provider resulting in or contributing to an Event triggering such notification requirement under Applicable Law. At EOHHS’ election, the Provider shall, in lieu of providing such reimbursement, provide or pay for such notifications directly in accordance with EOHHS’ instructions. Response to Legal Process. The Provider shall report to EOHHS, both verbally and in writing, any instance where PI or any other data obtained in connection with the Contract is subpoenaed or becomes the subject of a court or administrative order or other legal process. The Provider shall provide such report to EOHHS as soon as feasible upon receiving or otherwise becoming aware of the legal process; provided, that the Provider shall provide such report no later than five business days prior to the applicable response date. In response to such legal process, and in accordance with instructions from EOHHS, the Provider shall take all reasonable steps, including objecting to the request when appropriate, to comply with M.G.L. c. 66A § 2(k), 42 CFR § 431.306(f), 42 CFR Part 2 and any other Applicable Law. If EOHHS determines that it shall respond directly, the Provider shall cooperate and assist EOHHS in it...
