Common use of Reporting and Mitigating Unauthorized Uses and Disclosures of PHI Clause in Contracts

Reporting and Mitigating Unauthorized Uses and Disclosures of PHI. Immediately upon notice to the Business Associate, the Business Associate shall report to the Department any uses or disclosures of PHI not authorized by this Agreement. The Business Associate shall also notify the affected individual of the breach. If the breach affects more than 500 individuals, the Business Associate must contact the U.S. Health and Human Services Secretary and the media, under the American Recovery and Reinvestment Act of 2009. The Business Associate shall use its best efforts to mitigate the deleterious effects of any use or disclosure of PHI not authorized by this Agreement. Further, in the notice provided to the Department by the Business Associate regarding unauthorized uses and/or disclosures of PHI, the Business Associate shall describe the remedial or other actions undertaken or proposed to be undertaken regarding the unauthorized use or disclosure of PHI.