Reports of Improper Use or Disclosure or Breach. Business Associate hereby agrees that it shall notify the Covered Entity’s Project Officer and the Covered Entity’s Legal Office within two (2) days of discovery of any use or disclosure of PHI not provided for or allowed by this Attachment 5, including breaches of unsecured PHI as required by 45 CFR § 164.410. Such notification shall be written and shall include the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during the improper use or disclosure or Breach. Business Associate shall furnish Covered Entity with any other available information that Covered Entity is required to include in its notification to individuals under 45 CFR § 164.404(c) at the time of Business Associate’s notification to Covered Entity or promptly thereafter as such information becomes available. An improper use or disclosure or Breach shall be treated as discovered by the Business Associate on the first day on which it is known to the Business Associate (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of the Business Associate) or should reasonably have been known to the Business Associate to have occurred. Business Associate Agrees that if any of its employees, agents, contractors, Subcontractors, and representatives use or disclose PHI received from, or created or received on behalf of, Covered Entity, or any derivative de-identified information, Business Associate shall ensure that such employees, agents, contractors, Subcontractors, and business representatives shall receive training on Business Associate’s procedure for compliance with the HIPAA Rules. Business Associate Agrees that if any of its employees, agents, contractors, Subcontractors, and representatives use or disclose PHI received from, or created or received on behalf of, Covered Entity, or any derivative de-identified information in a manner not provided for in this Attachment 5, Business Associate shall ensure that such employees, agents, contractors, Subcontractors, and business representatives are sanctioned or prevented from accessing any PHI Business Associate receives from, or creates or receives on behalf of Covered Entity. Use or disclosure of PHI in a manner contrary to the terms of this Attachment 5 shall constitute a material breach of the Underlying Agreement.
Reports of Improper Use or Disclosure or Breach. The Business Associate hereby agrees that it shall notify the Director of the PSERS Health Insurance Office and the Premium Assistance Program’s Legal Office within two (2) days of discovery of any use or disclosure of PHI not provided for or allowed by this BAA, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410. Such notification shall be written and shall include the identification of each individual whose PHI constitutes Unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during the improper use or disclosure or Breach. The Business Associate shall furnish the Premium Assistance Program with any other available information that the Premium Assistance Program is required to include in its notification to individuals under 45 C.F.R. § 164.404(c) at the time of the Business Associate’s notification to the Premium Assistance Program or promptly thereafter as such information becomes available. An improper use or disclosure or Breach shall be treated as discovered by the Business Associate on the first day on which it is known to the Business Associate (including any person, other than the individual committing the breach, that is an employee, officer, contractor, subcontractor, representative or other agent of the Business Associate) or should reasonably have been known to the Business Associate to have occurred.
Reports of Improper Use or Disclosure or Breach. Business Associate hereby agrees that it shall notify the Covered Entity’s Project Officer and the Covered Entity’s Legal Office within two (2) days of discovery of any use or disclosure of PHI not provided for or allowed by this BAA, including breaches of unsecured PHI as required by 45 CFR § 164.410. Such notification shall be written and shall include the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during the improper use or disclosure or Breach. Business Associate shall furnish Covered Entity with any other available information that Covered Entity is required to include in its notification to individuals under 45 CFR § 164.404(c) at the time of Business Associate’s notification to Covered Entity or promptly thereafter as such information becomes available. An improper use or disclosure or Breach shall be treated as discovered by the Business Associate on the first day on which it is known to the Business Associate (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of the Business Associate) or should reasonably have been known to the Business Associate to have occurred.
