Reporting of Improper Access, Use or Disclosure or Breach. Every suspected and actual Breach shall be reported immediately, but no later than one (1) business day upon discovery, to CE’s Office of Compliance. Upon discovery of a Breach or suspected Breach, BA shall complete the following actions:
Reporting of Improper Access, Use or Disclosure or Breach. Every suspected and actual Breach must be reported immediately, but no later than one (1) business day upon discovery, to CE’s Office of Compliance and ITD’s CISO, consistent with the regulations under HITECH Act. Upon notification from BA, CE will coordinate notification of the actual or suspected Breach to the County HIPAA Privacy Officer. Upon discovery of a Breach or suspected Breach, BA must complete the following actions: Provide CE’s Office of Compliance and ITD’s CISO with the following information to include but not limited to: Date the Breach or suspected Breach occurred; Date the Breach or suspected Breach was discovered; Number of staff, employees, subcontractors, agents or other third parties and the names and titles of each person allegedly involved; Number of potentially affected Individual(s) with contact information; and Description of how the Breach or suspected Breach allegedly occurred. Conduct and document a risk assessment by investigating without unreasonable delay and in no case later than five (5) calendar days of discovery of the Breach or suspected Breach to determine the following: The nature and extent of the PHI involved, including the types of identifiers and likelihood of re-identification; The unauthorized person who had access to the PHI; Whether the PHI was actually acquired or viewed; and The extent to which the risk to PHI has been mitigated. Provide a completed risk assessment and investigation documentation to CE’s Office of Compliance and ITD’s CISO within ten (10) calendar days of discovery of the Breach or suspected Breach with a determination as to whether a Breach has occurred. At the discretion of CE, additional information may be requested. If BA and CE agree that a Breach has not occurred, notification to Individual(s) is not required. If a Breach has occurred, notification to the Individual(s) is required and BA must provide CE with affected Individual(s) name and contact information so that CE can provide notification. Make available to CE and governing state and federal agencies in a time and manner designated by CE or governing state and federal agencies, any policies, procedures, internal practices and records relating to a Breach or suspected Breach for the purposes of audit or should the CE reserve the right to conduct its own investigation and analysis. Access to PHI To the extent BA maintains a Designated Record Set on behalf of CE, BA must make PHI maintained by BA or its agents or subcontractors in ...
Reporting of Improper Access, Use or Disclosure or Breach. Business Associate shall report to Covered Entity’s Office of Compliance any unauthorized use, access or disclosure of unsecured PHI or any other security incident with respect to PHI no later than one (1) business day upon the discovery of a Breach or suspected Breach consistent with the regulations promulgated under HITECH by the United States Department of Health and Human Services, 45 CFR Part 164, Subpart D. Upon discovery of a Breach or suspected Breach, the Business Associate shall complete the following actions:
