Report of Prohibited Use or Disclosure a. In the event that Participant determines that the Data transmitted through the HIE or CRISP Services has been requested, used or disclosed by Participant or by a Participant User in a manner that does not comply with Applicable Law and/or the provisions of the Agreement, Participant will, in its reasonable discretion, take appropriate action consistent with the requirements of Applicable Law, and, consistent with bona- fide attorney-client or similar evidentiary privileges, provide notification to CRISP of the non- compliant use or disclosure in sufficient detail to allow CRISP to take remedial steps, including steps directed at preventing a reoccurrence, and cooperate with CRISP in assessing and taking reasonable and appropriate responsive measures. No notification under this Section 14.03 will be deemed to be an admission of fault or liability by Participant.
Report of Prohibited Use or Disclosure. Business Associate will report to the Covered Entity’s Office of Legal Affairs any use or disclosure not provided for by this Addendum or a breach of unsecured PHI in accordance with the requirements set forth in 45 C.F.R. 164.400-.414 within 10 business days from when it becomes aware of such use or disclosure by Business Associate, its officers, directors, employees, agents, or subcontractors or by a third party to whom the Business Associate disclosed PHI. In addition, Business Associate will report, following discovery and without unreasonable delay, any “Breach” of “Unsecured Protected Health Information” as required by 45 CFR 164.410. Any such report shall include the identification (if known) of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. Business Associate also will report to the Covered Entity any Security Incidents (as that term is defined in the HIPAA Security Rule) that results in the unauthorized access, use, disclosure, modification, or destruction of Covered Entity’s electronic Protected Health Information of which Business Associate becomes aware
Report of Prohibited Use or Disclosure. Business Associate will report to the Covered Entity’s Office of Legal Affairs any use or disclosure not provided for by this Addendum or a breach of unsecured PHI in accordance with the requirements set forth in 45 C.F.R. 164.400-.414 within 10 business days from when it becomes aware of such use or disclosure by Business Associate, its officers, directors, employees, agents, or subcontractors or by a third party to whom the Business Associate disclosed PHI. In addition, Business Associate will report, following discovery and without unreasonable delay, any “Breach” of “Unsecured Protected Health Information” as required by 45 CFR 164.410. Any such report shall include the identification (if known) of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach. Business Associate also will report to the Covered Entity any Security Incidents (as that term is defined in the HIPAA Security Rule) that results in the unauthorized access, use, disclosure, modification, or destruction of Covered Entity’s electronic Protected Health Information of which Business Associate becomes aware Privacy. To the extent that Business Associate is to carry out one or more of the Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business associate shall comply with the requirements of Subpart E that apply to Covered Entity in performance of its obligation(s) under the BAA. Business Associate shall also otherwise implement appropriate safeguards in accordance with the Privacy Standards to prevent the use and disclosure of PHI other than pursuant to the terms and conditions of this BAA.
