Vendors Who Are Covered Entities. In the event of a breach by the Vendor, or a contractor or subcontractor of the Vendor, and the Vendor is a HIPAA covered entity, the Vendor, not the Agency, shall be considered the covered entity for purposes of notification to the Secretary of HHS pursuant to 45 CFR 164.408. The Vendor shall be responsible for filing the notification to the Secretary of HHS and will identify itself as the covered entity in the notice. If the breach was with respect to 500 or more individuals, at least 5 business days prior to filing notice with the Secretary of HHS the Vendor shall provide a copy of the notice and breach risk assessment to the Agency for review. Upon prior review by the Agency of the notice and breach risk assessment, the Vendor shall file the notice with the Secretary of HHS within the notification timeframe imposed by 45 C.F.R. 164.408(b) and contemporaneously submit a copy of said notification to the Agency. If the breach was with respect to less than 500 individuals, the Vendor shall notify the Secretary of HHS within the notification timeframe imposed by 45 C.F.R. 164.408(c) and shall contemporaneously submit a copy of said notification to the Agency.
Vendors Who Are Covered Entities. In the event of a breach by a contractor or subcontractor of the Vendor, and the Vendor is a HIPAA covered entity, the Vendor shall be considered the covered entity for purposes of notification to the Secretary of HHS pursuant to 45 CFR 164.408. The Vendor shall be responsible for filing the notification to the Secretary of HHS and will identify itself as the covered entity in the notice. If the breach was with respect to 500 or more individuals, the Vendor shall provide a copy of the notice to the Agency, along with the Vendor’s breach risk assessment for review at least 15 business days prior to the date required by 45 C.F.R. 164.408 (b) for the Vendor to file the notice with the Secretary of HHS. If the breach was with respect to less than 500 individuals, the Vendor shall notify the Secretary of HHS within the notification timeframe imposed by 45 C.F.R. 164.408(c) and shall contemporaneously submit copies of said notifications to the Agency..
