HHS Notification Clause Samples

HHS Notification. In any case of a breach involving less than 500 patients (regardless of the State or jurisdiction), Business Associate, on behalf of the Provider, must record the breach in a centralized log of all breaches of unsecured PHI that occurred during the calendar year and annually submit the log to HHS (with a copy to Business Associate’s corporate office) no later than sixty (60) calendar days after the end of the calendar year. Notice of breaches affecting less than 500 individuals must be submitted electronically by using the breach notification form located at this website address: ▇▇▇▇://▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇.▇▇▇.▇▇▇/breach/index.cfm (or at any address located in subsequent guidance). A separate form must be completed for every breach that has occurred and has been logged on behalf of Provider during the calendar year. If Business Associate has submitted a breach notification form to the Secretary of HHS on behalf of Provider, and later discovers additional information to report, Business Associate may submit an additional form, checking the appropriate box to signal that it is an updated submission.