Reporting of Improper Use or Disclosure, Breach or Security Incident. Each Party shall report to the other Party any use or disclosure of PHI not provided for by the Agreement and this Addendum, including a Breach, within five (5) calendar days of becoming aware of such incident. Such notification shall include the identification of each individual whose Unsecured PHI has been, or is reasonably to have been, accessed, acquired or disclosed during the Breach. Each Party shall cooperate with the other Party in investigating the Breach so that each Party may meet its respective obligations under the HITECH Act., any other security breach notification law, or as required by contracts with other parties, including Covered Entities. Each Party shall report any Security Incident upon becoming aware of such incident; provided, however, that neither Party shall be required to report an immaterial incident consisting solely of trivial incidents that occur on a daily basis, such as scans, “pings,” or an unsuccessful attempt to improperly access Electronic PHI that is stored in an information system under its control.
Reporting of Improper Use or Disclosure, Breach or Security Incident. Business Associate shall report to Covered Entity any use or disclosure of Protected Health Information not provided for by this Agreement (or any other agreement between the Parties in which Business Associate acts as a business associate) within five (5) days of discovery of such incident. Business Associate shall report to Covered Entity any Breach of Unsecured PHI within five (5) days of discovery of such incident. Business Associate’s notification to Covered Entity of a Breach shall include: (i) the identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired or disclosed during the Breach; (ii) any particulars regarding the Breach that Covered Entity would need to include in its notification, as such particulars are identified in 42 U.S.C. § 17932 and 45 CFR § 164.404; and (iii) what steps, if any, have been taken by the Business Associate to mitigate the breach and/or prevent a similar breach from occurring in the future. Business Associate shall also cooperate with Covered Entity to conduct any risk assessment necessary to determine whether notification of breach is required. A Breach shall be treated as discovered by Business Associate as of the first day on which such Breach is known, or should reasonably have been known, to Business Associate. For purposes of this Section, the knowledge of any person, other than the individual committing the Breach, that is an employee, officer or other agent of Business Associate shall be imputed to Business Associate. Business Associate shall report to Covered Entity any Security Incident immediately if practicable but in any event within five (5) days of becoming aware of such Security Incident.
Reporting of Improper Use or Disclosure, Breach or Security Incident. Without unreasonable delay and, in any event, no more than forty-eight (48) hours after discovery, Receiving Party shall notify the Trustee and the Debtor/Covered Entity of any use or disclosure of PHI not provided for by the NDA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, incidents that pose a risk of constituting Breaches and any Security Incident of which it becomes aware. Receiving Party shall deliver the initial notification of such Breach, in writing, which must include: a reasonably detailed description of the Breach and the steps Receiving Party is taking, and would propose, to mitigate or terminate the Breach. Furthermore, Receiving Party shall supplement the initial notification, no more than ten (10) days following discovery (or following the date additional information becomes reasonably available to Receiving Party), with information including: (i) the identification of each individual whose PHI was or is believed to have been involved; (ii) a reasonably detailed description of the types of PHI involved; (iii) all other information reasonably requested by the Trustee or Debtor/Covered Entity, including all information necessary to enable the Trustee or Debtor/Covered Entity to perform and document a risk assessment in accordance with 45 C.F.R. Part 164 subpart D; and (iv) all other information necessary for the Trustee or Debtor/Covered Entity to provide notice to individuals, the U.S. Department of Health and Human Services (“HHS”) or the media, if required, and (v) appoint a liaison to provide contact information for same so that Receiving Party may ask questions or learn additional information concerning the Breach. In the event of a Breach or Security Incident caused by Receiving Party, Receiving Party shall, upon the request of the Trustee or the Debtor/Covered Entity, assist the Trustee or Debtor/Covered Entity in notifying individuals pursuant to 45 C.F.R. §§ 164.404 and 164.406. Following a Breach, Receiving Party will have a continuing duty to inform the Trustee and the Debtor/Covered Entity of new information learned by Receiving Party regarding the Breach; including, but not limited to, the information described in items (i) through (v) above.
Reporting of Improper Use or Disclosure, Breach or Security Incident. Without unreasonable delay and, in any event, no more than twenty four (24) hours after discovery, Subcontractor shall notify Company of any use or disclosure of PHI not provided for by the Underlying Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, incidents that pose a risk of constituting Breaches and any Security Incident of which it becomes aware. Subcontractor shall deliver the initial notification of such Breach, in writing, which must include: a reasonably detailed description of the Breach and the steps Subcontractor is taking, and would propose, to mitigate or terminate the Breach. Furthermore, Subcontractor shall supplement the initial notification, no more than ten (10) days following discovery (or following the date additional information becomes reasonably available to Subcontractor), with information including: (i) the identification of each individual whose PHI was or is believed to have been involved; (ii) a reasonably detailed description of the types of PHI involved; (iii) all other information reasonably requested by Company, including all information necessary to enable Company to perform and document a risk assessment in accordance with 45 C.F.R. Part 164 subpart D; and (iv) all other information necessary for Company to provide notice to individuals, the U.S. Department of Health and Human Services (“HHS”) or the media, if required. Despite anything to the contrary in the preceding provisions, in Company’s sole and absolute discretion and in accordance with Company’s directions, Subcontractor shall conduct, or pay the costs of conducting, an investigation of any Breach and shall provide or pay the costs of providing, any notices required by 45 C.F.R. §§ 164.404 and 164.406.
