Notification Obligations. During the term of this BAA, Business Associate shall notify Covered Entity as soon as is reasonably practicable but in no event later than five (5) calendar days after the discovery of any use and/or disclosure of PHI not permitted by this BAA, a Breach of Unsecured PHI, or any material Security Incident, and shall provide Covered Entity with information regarding the improper use and/or disclosure, Breach or Security Incident as required by law. In the event of a breach of Unsecured PHI, such notice shall include, to the extent possible, the name of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. Business Associate shall also, to the extent possible, furnish Covered Entity with any other available information that Covered Entity is required to include in its notification to Individuals under 45 CFR § 164.404(c) at the time of Business Associate’s notification to Covered Entity or promptly thereafter as such information becomes available.
Appears in 7 contracts
Samples: Oklahoma State Department Of, Oklahoma State Department of Health Business Associate Agreement, Oklahoma State Department of Health Business Associate Agreement
