Mitigation and Penalties. Business Associate must mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Breach or of a use or disclosure of PHI by Business Associate in violation of the requirements of this Business Associate Agreement. Business Associate shall take reasonable steps to put corrective measures in place to prevent future Breaches (such as retraining employees and upgrading security systems). At the City’s request, Business Associate shall take reasonable steps to mitigate the harm to affected Individuals whose PHI has been or may have been compromised as a result of a Breach by Business Associate, including obtaining credit monitoring services and offering identity theft insurance. To the extent that the City incurs civil or criminal monetary penalties as a result of a Breach by the Business Associate, the Business Associate agrees to reimburse the City for such penalties.
