Report Inappropriate Uses or Disclosures, Security Incidents, and Breaches of Unsecured PHI Sample Clauses

Report Inappropriate Uses or Disclosures, Security Incidents, and Breaches of Unsecured PHI. Upon discovery, Business Associate agrees to report to Covered Entity in writing any use or disclosure of PHI by Business Associate not permitted by this Agreement; any Security Incident; and any breach of unsecured PHI as required by 45 CFR §164.410 as follows: In the event that Business Associate discovers a breach of unsecured PHI, Business Associate agrees to notify Covered Entity without unreasonable delay, and in no case later than 60 calendar days after Business Associate first becomes aware of the incident. Business Associate is deemed to have become aware of the breach as of the first day such breach is known or, with the exercise of reasonable diligence, would have been known to any person, other than the person committing the breach, who is an employee, officer, or other agent of Business Associate. The notice must include, to the extent possible, the identification of each individual whose unsecured PHI was the subject of the breach; a brief description of what happened; the date of the breach and the date of the discovery of the breach, if known; a description of the types of unsecured PHI that were involved in the breach (such as full name, social security number, date of birth, and home address); any steps the individuals should take to protect themselves from potential harm resulting from the breach; and a brief description of what Business Associate is doing to investigate the breach, mitigate losses, and protect against further breaches.