Reporting to Individuals. In the case of a breach of PHI or PII discovered by the Business Associate, the Business Associate shall first notify the County of the pertinent details of the breach and, upon prior approval of the County’s Privacy Officer, shall notify each individual whose unsecured PHI or PII has been, or is reasonably believed by the Business Associate to have been, accessed, acquired or disclosed as a result of such breach. Such notification shall be in writing by first-class mail to the individual (or the next of kin if the individual is deceased) at the last known address of the individual or next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. Where there is insufficient or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes written (or, if specifically requested, electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are ten (10) or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting on the web site of the Business Associate involved or notice in major print of broadcast media, including major media in the geographic areas where the individuals affected by the breach are likely to reside. In any case deemed by the Business Associate to require urgency because of possible imminent misuse of unsecured PHI or PII, the Business Associate may also provide information to individuals by telephone or other means, as appropriate.
Reporting to Individuals. OKSHINE must provide the report to Individuals in writing, by first class mail, sent to the last known address of the Individual (or to the next of kin or personal representative if the Individual is deceased). If an Individual has specified a preference for electronic mail in communications with OKSHINE, then OKSHINE must use electronic mail. In any case in which there is insufficient or out-of-date information to provide the written notice required, OKSHINE must include a conspicuous posting on its website that includes a toll-free phone number so that affected Individuals may learn whether or not their Unsecured PHI may have been included in the breach. REPORTING TO OKSHINE Participant will immediately notify OKSHINE Help Desk at (000) 000-0000 (option 4) of any breach of Unsecured PHI. REPORTING TO THE MEDIA If OKSHINE believes that the breach of Unsecured PHI involved more than 500 Individuals residing within a State, OKSHINE also must provide notice to prominent media outlets serving that State. The media announcement must include a toll-free phone number so that Individuals may learn whether or not their Unsecured PHI may have been included in the breach. REPORTING TO HHS If OKSHINE believes that the breach of Unsecured PHI involved 500 or more Individuals, OKSHINE must also immediately notify the Secretary of the U.S. Department of Health and Human Services (HHS), and must indicate in its notice to HHS that the report is made on behalf of Participants in the OKSHINE to avoid duplicative reporting. For breaches affecting fewer than 500 individuals, OKSHINE will maintain a log of all such breaches occurring during the year and annually submit such log to the Secretary. RESPONSIBILITY OF VENDOR If Vendor discovers a breach or suspicious transaction and considers it necessary to take immediate action, it may suspend the Authorized User’s access to the OKSHINE immediately. Vendor shall notify the OKSHINE of the action, reason for its action, and collaborate with the OKSHINE ED, or designee, to address the incident. OKSHINE RESPONSE TO A BREACH The OKSHINE may conduct an investigation of the breach as outlined in SECURITY INCIDENT POLICY, to determine the extent of the breach, determine corrective actions, and may apply sanctions, as considered necessary. Participants shall cooperate in any investigation conducted by OKSHINE, state, or federal government authorities. OKSHINE shall document its findings and any actions taken in response to an investigatio...
Reporting to Individuals. In the case of a breach of PHI or PII discovered by the Business Associate, the Business Associate shall first notify the County of the pertinent details of the breach and, upon prior approval of the County’s Privacy Officer, shall notify each individual whose unsecured PHI or PII has been, or is reasonably believed by the Business Associate to have been, accessed, acquired or disclosed as a result of such breach. Such notification shall at Business Associate’s sole cost and expense, and shall be in writing by first-class mail to the individual (or the next of kin if the individual is deceased) at the last known address of the individual or next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. In any case deemed by the Business Associate to require urgency because of possible imminent misuse of unsecured PHI or PII, the Business Associate may also provide information to individuals by telephone or other means, as appropriate.
