Notification of Breach of Unsecured PHI. In addition to the notification set forth in Section 3(j), Business Associate agrees to report to Covered Entity any breach of Unsecured PHI as provided herein. Notification by Business Associate to Covered Entity must be made in writing, as soon as possible, but not more than thirty (30) calendar days from the discovery of a breach by Business Associate. For purposes hereof, the term “discovery of a breach” shall mean that Business Associate, or an employee, officer, director, or agent of Business Associate, has acquired actual knowledge of a breach, or through the exercise of reasonable diligence and inquiry, should have acquired knowledge of a breach. The notification to the Covered Entity shall include, to the extent possible, the following information:
Notification of Breach of Unsecured PHI. Upon any breach, Business Associate shall evaluate whether such breach is a "Breach" requiring notice under HIPAA's Privacy Rule or Security Standards. Following Business Associate's discovery of a Breach of Unsecured Protected Health Information (Unsecured PHI) in Business Associate's control, as both terms are defined in 45 CFR § 164.402, Business Associate shall:
Notification of Breach of Unsecured PHI. To the extent Company accesses, maintains, retains, modifies, records, stores, destroys or otherwise holds, uses or discloses Unsecured PHI, Company shall, following the Discovery of a Breach of such PHI, notify Client of such Breach. Such notice shall include detailed information about the breach and the name and contact information of each individual whose Unsecured PHI has been, or is reasonably believed by Company to have been, accessed, acquired or disclosed during such Breach. A notification required pursuant to this paragraph shall be promptly, but in any case, no later than fifteen (15) calendar days after the discovery of a Breach by Company. A Breach shall be treated as discovered by Company as of the first day on which such Breach is known to Company or the first day on which such Breach would have been known to Company had Company exercised reasonable diligence. Company shall be deemed to have knowledge of a Breach if the Breach is known or should have been known by the exercise of reasonable diligence to any person, other than the person committing the breach, who is an employee, officer, or other agent of Company (determined in accordance with the Federal common law of agency).
