Reporting of Improper Disclosures of PHI. If the Management Company discovers a (i) use or disclosure of PHI in violation of this Agreement by the Management Company or a third party to which the Management Company disclosed PHI, (ii) Successful Security Incident (as defined herein) or (iii) Breach of Unsecured PHI, then the Management Company will report the use or disclosure in accordance with HIPAA to the Professional Company without unreasonable delay and in any event within 60 calendar days after its discovery. “Successful Security Incident” means successful unauthorized access, use, disclosure, modification, or destruction of Electronic PHI or interference with system operations in an Information System in a manner that materially risks the Confidentiality, Integrity, or Availability of such PHI. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful attempts at such unauthorized access, use, disclosure, modification, or destruction, such as pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information where the key is not compromised, or any combination of the above. EXHIBIT TO MANAGEMENT SERVICES AGREEMENT
Reporting of Improper Disclosures of PHI. If the Service Company discovers a (i) use or disclosure of PHI in violation of this Agreement by the Service Company or a third party to which the Service Company disclosed PHI, (ii) Successful Security Incident (as defined herein) or (iii) Breach of Unsecured PHI, then the Service Company will report the use or disclosure in accordance with HIPAA and applicable state privacy laws to the Professional Company without unreasonable delay and in any event within 10 calendar days after its discovery (or such earlier time frame as may be required under applicable state Law). “Successful Security Incident” means successful unauthorized access, use, disclosure, modification, or destruction of Electronic PHI or interference with system operations in an Information System in a manner that materially risks the Confidentiality, Integrity, or Availability of such PHI. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful attempts at such unauthorized access, use, disclosure, modification, or destruction, such as pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information where the key is not compromised, or any combination of the above.
Reporting of Improper Disclosures of PHI. (i) If the Management Company becomes aware of a use or disclosure of PHI in violation of this Agreement by the Management Company or a third party to which the Management Company disclosed PHI, then the Management Company will report the use or disclosure to the Company without unreasonable delay.
Reporting of Improper Disclosures of PHI. Business Associate shall, within ten (10) business days of Discovery, report to Covered Entity any confirmed use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. 164.410, and any confirmed Security Incident. The parties agree that this Section 1.6 satisfies any notices necessary by Business Associate to Covered Entity of the ongoing existence and occurrence of Unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. For purposes of this BAA, such Unsuccessful Security Incidents include activity such as pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denial of service and any combination of the above, so long as no such Unsuccessful Security Incident results in unauthorized access, use, disclosure, modification or destruction of PHI or interference with information system operations.
Reporting of Improper Disclosures of PHI. Business Associate acknowledges that it is required by law to comply with the HIPAA security rule (45 C.F.R. 164.302 through 164.318) and the use and disclosure provisions of the HIPAA privacy rule (45 C.F.R. 162.502, 162.504). Business Associate shall immediately, but in no event later than five (5) days after becoming aware of any use or disclosure of PHI in violation of this Agreement – or in violation of the HIPAA Rules – whether by Business Associate, its officers, directors, employees, contractors or agents, (or by a third party to which Business Associate disclosed PHI) report any such disclosure or privacy or security breach to Covered Entity. Business Associate agrees to (a) fully cooperate with Covered Entity in the investigation of any such improper disclosure or privacy or security breach; and (b) fully mitigate any harmful effect resulting from any such improper disclosure or privacy or security breach. Business Associate shall provide written notice to Covered Entity, in the timeframe referenced above, of each of the following: (i) the date of the breach; (ii) the date of the discovery of the breach; (iii) a description of the types of unsecured PHI that were involved; (iv) identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed; and (v) any other details necessary to complete an assessment of the risk of harm to any individual(s). Covered Entity will be responsible to provide notification to individuals whose unsecured PHI has been disclosed, as well as any required disclosure to the Secretary. Business Associate agrees to establish procedures to investigate the breach, mitigate losses and protect against any future breaches, and to provide a description of these procedures and the specific findings of the investigation to Covered Entity.
