2023/11/29 Council Agenda Packet

10 Associate, upon request by the Covered Entity, will provide Covered Entity all information relevant to Business Associate’s written assessment of harm to affected Individuals. (3) Breach Notification to Individuals. Business Associate expressly recognizes that Covered Entity has certain reporting and disclosure obligations to the Secretary and the Individual in case of a security breach of Unsecured PHI. Business Associate must provide to Covered Entity in writing all information necessary for Covered Entity to comply with Sub Title D Title IV Section 13402 of the HITECH Act without reasonable delay, and in no case later than 30 days following the discovery of the breach. Business Associate’s duty to notify Covered Entity of any breach does not permit Business Associate to notify those Individuals whose PHI has been breached by Business Associate without the express written permission of Covered Entity to do so. Any and all notification to those Individuals whose PHI has been breached will be made under the direction, review and control of Covered Entity. (4) Breach Notification for Other Confidential Personal Information. In addition to the reporting under paragraph 1, Business Associate will notify Covered Entity of any breach of computerized Confidential Personal Information. Such notification will include the information required under paragraph (2) above. (5) Mitigation. In the event of a Breach by Business Associate or any Representative, Business Associate at its sole cost will, in consultation with Covered Entity, mitigate, to the extent practicable, any harmful effect of such Breach that is known to Business Associate. Business Associate will cooperate with Covered Entity in preparing and providing notification to affected Individuals or Secretary of a Breach of Unsecured PHI that the Covered Entity determines is appropriate. The Business Associate will pay all reasonable costs incurred by Covered Entity related to addressing a Breach of Unsecured PHI maintained or under the control of Business Associate or its Representatives. B. Improper Disclosures. Business Associate will track all disclosures of PHI to third parties, including those made to Business Associate’s Representatives, other than those disclosures that meet the exception criteria of 45 CFR § 164.528. Business Associate will report to Covered Entity any use or disclosure of any PHI by Business Associate or its Representatives that does not constitute a Breach, but is an unauthorized or improper use or disclosure of any PHI under this Agreement or applicable federal and state laws. Business Associate will report to Covered Entity any such unauthorized use or disclosure as soon as practicable, but in no event later than five (5) business days of the date on which Business Associate becomes aware of such use or disclosure. In the event of an unauthorized use or disclosure, Business Associate will at its sole cost, in consultation with Covered Entity, mitigate, to the extent practicable, any harmful effect of any such disclosure that is known to Business Associate under the same terms that Business Associate would mitigate a Breach. C. Security Incidents. Business Associate will report to Covered Entity any attempted or successful (1) unauthorized access, use, disclosure, modification, or destruction of Electronic PHI, or (2) interference with Business Associate’s system operations in Business Associate’s information systems that contain Electronic PHI, of which Business