Common use of Reporting of Improper Use or Disclosure and Notification of Breach Clause in Contracts

Reporting of Improper Use or Disclosure and Notification of Breach. Business Associate shall, as soon as reasonably possible, but immediately after discovery of a Breach, notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement, including a Breach of Unsecured Protected Health Information as such notice is required by 45 C.F.R. 164.410 or a breach for which notice is required under § 00-00-000, C.R.S. Such notice shall include the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. Business Associate shall, as soon as reasonably possible, but immediately after discovery of any Security Incident that does not constitute a Breach, notify Covered Entity of such incident. Business Associate shall have the burden of demonstrating that all notifications were made as required, including evidence demonstrating the necessity of any delay.

Reporting of Improper Use or Disclosure and Notification of Breach. Business Associate shall, as soon as reasonably possible, but immediately after discovery of a Breach, notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement, including a Breach of Unsecured Protected Health Information as such notice is required by 45 C.F.R. 164.410 or a breach for which notice is required under § §00-00-000, C.R.S. Such notice shall include the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. Business Associate shall, as soon as reasonably possible, but immediately after discovery of any Security Incident that does not constitute a Breach, notify Covered Entity of such incident. Business Associate shall have the burden of demonstrating that all notifications were made as required, including evidence demonstrating the necessity of any delay.