Laserfiche WebLink
14 <br />notification to the Covered Entity with a report that meets the requirements <br />outlined immediately below. <br />(viii)Reporting Obligations – Details. <br />a.For Successful Security Incidents and Breaches, Business Associate <br />–without unreasonable delay and in no event later than thirty (30) calendar <br />days after Business Associate learns of such nonpermitted use or disclosure <br />(whether at Business Associate or at Business Associate Subcontractor) – <br />shall provide Covered Entity a report that shall: <br />i.Identify (if known) each individual whose Unsecured Protected Health <br />Information has been, or is reasonably believed by Business Associate <br />to have been accessed, acquired, or disclosed; <br />ii.Identify the nature of the non-permitted access, use, or disclosure <br />including the date of the incident and the date of discovery; <br />iii.Identify the PHI accessed, used, or disclosed (e.g., name; social <br />security number; date of birth); <br />iv.Identify what corrective action Business Associate (or Business <br />Associate Subcontractor) took or shall take to prevent further non- <br /> permitted accesses, uses, or disclosures; <br />v.Identify what Business Associate (or Business Associate <br />Subcontractor) did or shall do to mitigate any deleterious effect of <br />the non-permitted access, use, or disclosure; and <br />vi.Provide such other information, including a written report, as the <br />Covered Entity may reasonably request. <br />b.For Unsuccessful Security Incidents, Business Associate shall provide <br />Covered Entity, upon its written request, a report that: (i) identifies the <br />categories of Unsuccessful Security Incidents as described in this BAA; (ii) <br />indicates whether Business Associate believes its (or its Business Associate <br />Subcontractor’s) current defensive security measures are adequate to address <br />all Unsuccessful Security Incidents, given the scope and nature of such <br />attempts; and (iii) if the security measures are not adequate, the measures <br />Business Associate (or Business Associate Subcontractor) shall implement to <br />address the security inadequacies.