Notice and Procedures If any suit, action, proceeding (including any governmental or regulatory investigation), claim or demand shall be brought or asserted against any person in respect of which indemnification may be sought pursuant to either paragraph (a) or (b) above, such person (the “Indemnified Person”) shall promptly notify the person against whom such indemnification may be sought (the “Indemnifying Person”) in writing; provided that the failure to notify the Indemnifying Person shall not relieve it from any liability that it may have under paragraph (a) or (b) above except to the extent that it has been materially prejudiced (through the forfeiture of substantive rights or defenses) by such failure; and provided, further, that the failure to notify the Indemnifying Person shall not relieve it from any liability that it may have to an Indemnified Person otherwise than under paragraph (a) or (b) above. If any such proceeding shall be brought or asserted against an Indemnified Person and it shall have notified the Indemnifying Person thereof, the Indemnifying Person shall retain counsel reasonably satisfactory to the Indemnified Person (who shall not, without the consent of the Indemnified Person, be counsel to the Indemnifying Person) to represent the Indemnified Person in such proceeding and shall pay the fees and expenses of such counsel related to such proceeding, as incurred. In any such proceeding, any Indemnified Person shall have the right to retain its own counsel, but the fees and expenses of such counsel shall be at the expense of such Indemnified Person unless (i) the Indemnifying Person and the Indemnified Person shall have mutually agreed to the contrary; (ii) the Indemnifying Person has failed within a reasonable time to retain counsel reasonably satisfactory to the Indemnified Person; (iii) the Indemnified Person shall have reasonably concluded that there may be legal defenses available to it that are different from or in addition to those available to the Indemnifying Person; or (iv) the named parties in any such proceeding (including any impleaded parties) include both the Indemnifying Person and the Indemnified Person and representation of both parties by the same counsel would be inappropriate due to actual or potential differing interest between them. It is understood and agreed that the Indemnifying Person shall not, in connection with any proceeding or related proceedings in the same jurisdiction, be liable for the fees and expenses of more than one separate firm (in addition to any local counsel) for all Indemnified Persons, and that all such fees and expenses shall be paid or reimbursed as they are incurred. Any such separate firm for any Underwriter, its affiliates, directors and officers and any control persons of such Underwriter shall be designated in writing by the Representatives and any such separate firm for the Company, its directors, its officers who signed the Registration Statement and any control persons of the Company shall be designated in writing by the Company. The Indemnifying Person shall not be liable for any settlement of any proceeding effected without its written consent, but if settled with such consent or if there be a final judgment for the plaintiff, the Indemnifying Person agrees to indemnify each Indemnified Person from and against any loss or liability by reason of such settlement or judgment. Notwithstanding the foregoing sentence, if at any time an Indemnified Person shall have requested that an Indemnifying Person reimburse the Indemnified Person for fees and expenses of counsel as contemplated by this paragraph, the Indemnifying Person shall be liable for any settlement of any proceeding effected without its written consent if (i) such settlement is entered into more than 30 days after receipt by the Indemnifying Person of such request and (ii) the Indemnifying Person shall not have reimbursed the Indemnified Person in accordance with such request prior to the date of such settlement. No Indemnifying Person shall, without the written consent of the Indemnified Person, effect any settlement of any pending or threatened proceeding in respect of which any Indemnified Person is or could have been a party and indemnification could have been sought hereunder by such Indemnified Person, unless such settlement (x) includes an unconditional release of such Indemnified Person, in form and substance reasonably satisfactory to such Indemnified Person, from all liability on claims that are the subject matter of such proceeding and (y) does not include any statement as to or any admission of fault, culpability or a failure to act by or on behalf of any Indemnified Person.
BREACH DISCOVERY AND NOTIFICATION 17 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 18 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 19 law enforcement official pursuant to 45 CFR § 164.412.
20 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 21 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 22 known to CONTRACTOR.
23 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 24 known, or by exercising reasonable diligence would have known, to any person who is an employee, 25 officer, or other agent of CONTRACTOR, as determined by federal common law of agency.
26 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 27 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 28 notification within twenty four (24) hours of the oral notification.
29 3. CONTRACTOR’s notification shall include, to the extent possible:
30 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 31 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;
32 b. Any other information that COUNTY is required to include in the notification to 33 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 34 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 35 period set forth in 45 CFR § 164.410 (b) has elapsed, including:
36 1) A brief description of what happened, including the date of the Breach and the date 37 of the discovery of the Breach, if known;
1 2) A description of the types of Unsecured PHI that were involved in the Breach (such 2 as whether full name, social security number, date of birth, home address, account number, diagnosis, 3 disability code, or other types of information were involved);
4 3) Any steps Individuals should take to protect themselves from potential harm 5 resulting from the Breach;
6 4) A brief description of what CONTRACTOR is doing to investigate the Breach, to 7 mitigate harm to Individuals, and to protect against any future Breaches; and
8 5) Contact procedures for Individuals to ask questions or learn additional information, 9 which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.
10 4. COUNTY may require CONTRACTOR to provide notice to the Individual as required in 11 45 CFR § 164.404, if it is reasonable to do so under the circumstances, at the sole discretion of the 12 COUNTY.
13 5. In the event that CONTRACTOR is responsible for a Breach of Unsecured PHI in violation 14 of the HIPAA Privacy Rule, CONTRACTOR shall have the burden of demonstrating that 15 CONTRACTOR made all notifications to COUNTY consistent with this Subparagraph F and as 16 required by the Breach notification regulations, or, in the alternative, that the acquisition, access, use, or 17 disclosure of PHI did not constitute a Breach.
18 6. CONTRACTOR shall maintain documentation of all required notifications of a Breach or 19 its risk assessment under 45 CFR § 164.402 to demonstrate that a Breach did not occur.
20 7. CONTRACTOR shall provide to COUNTY all specific and pertinent information about the 21 Breach, including the information listed in Section E.3.b.(1)-(5) above, if not yet provided, to permit 22 COUNTY to meet its notification obligations under Subpart D of 45 CFR Part 164 as soon as 23 practicable, but in no event later than fifteen (15) calendar days after CONTRACTOR’s initial report of 24 the Breach to COUNTY pursuant to Subparagraph F.2. above.
25 8. CONTRACTOR shall continue to provide all additional pertinent information about the
