BREACH DISCOVERY AND NOTIFICATION 17 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 18 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 19 law enforcement official pursuant to 45 CFR § 164.412.
20 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 21 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 22 known to CONTRACTOR.
23 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 24 known, or by exercising reasonable diligence would have known, to any person who is an employee, 25 officer, or other agent of CONTRACTOR, as determined by federal common law of agency.
26 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 27 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 28 notification within twenty four (24) hours of the oral notification.
29 3. CONTRACTOR’s notification shall include, to the extent possible:
30 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 31 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;
32 b. Any other information that COUNTY is required to include in the notification to 33 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 34 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 35 period set forth in 45 CFR § 164.410 (b) has elapsed, including:
36 1) A brief description of what happened, including the date of the Breach and the date 37 of the discovery of the Breach, if known;
1 2) A description of the types of Unsecured PHI that were involved in the Breach (such 2 as whether full name, social security number, date of birth, home address, account number, diagnosis, 3 disability code, or other types of information were involved);
4 3) Any steps Individuals should take to protect themselves from potential harm 5 resulting from the Breach;
6 4) A brief description of what CONTRACTOR is doing to investigate the Breach, to 7 mitigate harm to Individuals, and to protect against any future Breaches; and
8 5) Contact procedures for Individuals to ask questions or learn additional information, 9 which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.
10 4. COUNTY may require CONTRACTOR to provide notice to the Individual as required in 11 45 CFR § 164.404, if it is reasonable to do so under the circumstances, at the sole discretion of the 12 COUNTY.
13 5. In the event that CONTRACTOR is responsible for a Breach of Unsecured PHI in violation 14 of the HIPAA Privacy Rule, CONTRACTOR shall have the burden of demonstrating that 15 CONTRACTOR made all notifications to COUNTY consistent with this Subparagraph F and as 16 required by the Breach notification regulations, or, in the alternative, that the acquisition, access, use, or 17 disclosure of PHI did not constitute a Breach.
18 6. CONTRACTOR shall maintain documentation of all required notifications of a Breach or 19 its risk assessment under 45 CFR § 164.402 to demonstrate that a Breach did not occur.
20 7. CONTRACTOR shall provide to COUNTY all specific and pertinent information about the 21 Breach, including the information listed in Section E.3.b.(1)-(5) above, if not yet provided, to permit 22 COUNTY to meet its notification obligations under Subpart D of 45 CFR Part 164 as soon as 23 practicable, but in no event later than fifteen (15) calendar days after CONTRACTOR’s initial report of 24 the Breach to COUNTY pursuant to Subparagraph F.2. above.
25 8. CONTRACTOR shall continue to provide all additional pertinent information about the
POST-REVIEW DISCOVERIES If, during the implementation of an undertaking, a previously unidentified property that may be eligible for inclusion in the National Register is encountered, or a known historic property may be affected in an unanticipated manner, the Agency Official shall follow 36 C.F.R. § 800.13(b).
A. In the event that previously unidentified archeological sites or human remains are discovered during project construction, that portion of the project shall stop immediately and the project manager shall take appropriate steps to immediately secure the site, and shall notify the Agency Official within 48 hours. The Agency Official shall immediately notify the SHPO/THPO, Tribes, and other relevant consulting parties including descendent communities.
B. If human remains are discovered, they shall be respectfully covered over and protected. In addition, the project manager shall immediately notify local and/or state law enforcement authorities including medical examiner or coroner, pursuant to local and state law.
C. The Agency Official shall consult with the SHPO/THPO and Tribes or other descendent community representatives to determine if the discovered site appears eligible for the National Register. If it does appear eligible, the Agency Official shall submit a treatment plan for the avoidance, protection, recovery of information, or destruction without data recovery to the SHPO for review and comment. The treatment plan shall be consistent with the ACHP’s handbook Treatment of Archaeological Properties and subsequent amendments and SHPO Human Remains Discovery Protocol. If human remains are discovered, the treatment plan shall follow the guidance in Advisory Council on Historic Preservation Policy Statement Regarding Treatment of Burial Sites, Human Remains and Funerary Objects, including appropriate consultation with descendent communities. Avoidance and preservation in place are the preferred options for treating human remains.
D. The Agency Official shall notify relevant consulting parties of the unanticipated discovery and provide the proposed treatment plan for their comment. Construction work in the area of the discovery shall not continue until the plan has been accepted by SHPO/THPO and implemented.
E. An undertaking that may affect a human burial site shall comply with provisions of New York State and local laws, the terms of this Agreement notwithstanding.
STATEWIDE ACHIEVEMENT TESTING When CONTRACTOR is a NPS, per implementation of Senate Bill 484, CONTRACTOR shall administer all Statewide assessments within the California Assessment of Student Performance and Progress (“CAASPP”), Desired Results Developmental Profile (“DRDP”), California Alternative Assessment (“CAA”), achievement and abilities tests (using LEA-authorized assessment instruments), the Fitness Gram, , the English Language Proficiency Assessments for California (“ELPAC”), and as appropriate to the student, and mandated by LEA pursuant to LEA and state and federal guidelines. CONTRACTOR is subject to the alternative accountability system developed pursuant to Education Code section 52052, in the same manner as public schools. Each LEA student placed with CONTRACTOR by the LEA shall be tested by qualified staff of CONTRACTOR in accordance with that accountability program. ▇▇▇ shall provide test administration training to CONTRACTOR’S qualified staff. CONTRACTOR shall attend LEA test training and comply with completion of all coding requirements as required by ▇▇▇.
