Reporting of Breaches of Privacy or Security. (A) Following the discovery of (I) any access to, use or disclosure of PHI which is not permitted by the Participation Agreement (including any Breach of Privacy or Security) or
Reporting of Breaches of Privacy or Security. (A) Following the discovery of (I) any access to, Use or Disclosure of PHI which is not permitted by the System Access License Agreement (including any Breach of Privacy or Security) or (II) any Security Incident, Business Associate shall notify Covered Entity by contacting Covered Entity’s designated privacy contact person without unreasonable delay, and in no case later than forty-eight (48) hours after discovery of the Breach of Privacy or Security of the Security Incident; provided, however, that the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Covered Entity by Business Associate shall be required only upon request. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, Use or Disclosure of PHI. Covered Entity will advise Business Associate of any subsequent changes to the privacy contact person’s contact information.
Reporting of Breaches of Privacy or Security. Following the discovery of (I) any access to, use or disclosure of PHI which is not permitted by the Participation Agreement (including any Breach of Privacy or Security) or (II) any Security Incident, Business Associate shall notify Covered Entity by contacting Covered Entity’s designated privacy contact person without unreasonable delay, and in no case later than forty-eight (48) hours after discovery of the Breach of Privacy or Security of the Security Incident; provided, however, that the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Covered Entity by Business Associate shall be required only upon request. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI. Covered Entity will advise Business Associate of any subsequent changes to the privacy contact person’s contact information. In the event of a Breach of Privacy or Security, Business Associate shall without unreasonable delay carry out an investigation and shall provide reasonably frequent updates to Covered Entity as to the results of the investigation, including, as soon as reasonably possible, the identification of each Patient whose PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during any Breach of Privacy or Security. Business Associate shall cooperate with Covered Entity and shall provide that assistance as Covered Entity may reasonably request so that Covered Entity may comply with any obligations it may have to investigate, remediate, mitigate, report, and or otherwise notify third parties of that Breach of Privacy or Security.
