Risk Assessment and Investigation. Business Associate shall perform an appropriate risk assessment immediately following the discovery of any unauthorized access, use or disclosure of PHI to determine whether use, access, or disclosure is one that “poses a significant risk of financial, reputation or other harm to the individual.” In performing the Risk Assessment, Business Associate should consider a combination of factors such as: (a) who impermissibly used the PHI or to whom the PHI was impermissibly disclosed; (b) was the impermissibly disclosed PHI returned prior to it being accessed for an improper purpose; and (c) the type and amount of PHI involved in the impermissible use or disclosure. Upon the Covered Entity’s request, Business Associate shall permit a Covered Entity staff member to participate in the investigation. i The results, including all documentation and reports produced during such Risk Assessment and Investigation, shall be provided to Covered Entity in writing, without unreasonable delay and in no event later than thirty (30) days from the date of discovery of the unauthorized access, use or disclosure. In addition to the Risk Assessment conducted by the Business Associate, Covered Entity reserves the right to conduct its own investigation of any unauthorized access, use or disclosure of PHI occurring at any facility, site or location of Business Associate, its agents or subcontractors or through any systems under the control of the Business Associate, its agents or subcontractors. Business Associate shall cooperate with Covered Entity to conduct such investigation. Covered Entity agrees to provide advance notice of such investigation, to protect the confidentiality of and not disclose any confidential and proprietary information of Business Associate to which Covered Entity has access during the course of such investigation.
Risk Assessment and Investigation. Business Associate shall perform an appropriate risk assessment immediately following the discovery of any unauthorized access, use or disclosure of PHI to determine whether use, access, or disclosure is one that “poses a significant risk of financial, reputational, or other harm to the individual.” In performing the Risk Assessment, Business Associate should consider a combination of factors such as: (a) who impermissibly used the PHI or to whom the PHI was impermissibly disclosed; (b) was the impermissibly disclosed PHI returned prior to it being accessed for improper purpose; and (c) the type and amount of PHI involved in the impermissible use or disclosure. The results of such Risk Assessment shall be provided to Covered Entity in writing without unreasonable delay and in no case later than 15 days from the date of discovery of the unauthorized access, use or disclosure. In addition to the Risk Assessment conducted by Business Associate, Covered Entity reserves the right to conduct its own investigation of any unauthorized access, use or disclosure of PHI occurring at any facility, site or location of Business Associate, its agents or subcontractors or through any systems under the control of the Business Associate, its agents or subcontractors. Business Associate shall cooperate with Covered Entity to conduct such investigation. Covered Entity agrees to provide advance notice of such investigation and to protect the confidentiality of all confidential and proprietary information of Business Associate to which Covered entity has access during the course of such investigation.
Risk Assessment and Investigation. Business Associate shall perform an appropriate risk assessment immediately following the discovery of any unauthorized access, use or disclosure of PHI to determine whether use, access, or disclosure is one “that compromises the security or privacy” of the PHI. In performing the Risk Assessment, Business Associate should consider a combination of factors such as: (a) who impermissibly used the PHI or to whom the PHI was impermissibly disclosed; (b) was the impermissibly disclosed PHI returned prior to it being accessed for improper purpose; (c) the type and amount of PHI involved in the impermissible use or disclosure; and (d) the extent to which the risk to the PHI has been mitigated. The results of such Risk Assessment shall be provided to Covered Entity in writing without unreasonable delay and in no case later than ten (10) days from the date of discovery of the unauthorized access, use or disclosure, unless the Parties mutually agree to extend such ten (10) day deadline or if a law enforcement official determines that a notification would impede investigation or cause damage to national security.
