BMI Audit Services LLC 2/22/2019

BML:> BMI Audit Services Security Incidents that are attempted but unsuccessful, Business Associate may notify Covered Entity in a monthly aggregate report. Covered Entity and Business Associate agree to act together in good faith to take reasonable steps to investigate and mitigate any harm caused by such unauthorized use or Security Incident. 3.14 Breach of Unsecured PHI. A Breach occurs when a use or disclosure of PHI violates the Privacy Rule and compromises the security or privacy of the PHI. Once a violation is discovered, the Business Associate must presume that a breach has occurred unless it can demonstrate that there is a "low probability" that the PHI has been compromised based on a risk assessment consisting of the four factors described below. Prior to conducting the risk assessment described herein, the Business Associate must provide an initial notification to the Covered Entity of a suspected Breach as described in(a). (a) Initial Notification.The Business Associate shall notify the Covered Entity on the same business day it discovers a Breach or suspected Breach of Unsecured PHI. (b) Risk Assessment. The risk assessment is fact specific and should consider the following at a minimum: (i) The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; (ii) The unauthorized person who used the PHI or to whom the disclosure was made; (iii) Whether the PHI was actually acquired or viewed and (iv) The extent to which the risk to the PHI has been mitigated. If after the risk assessment the Business Associate concludes there is more than a "low probability" that the PHI has been compromised, and no exception from 45 C.F.R. § 164.402(2) applies, then notifications must be provided in accordance with(c), (d), and(e) below. (c) Follow Up Notification. When a Business Associate discovers a Breach of Unsecured PHI, the Business Associate shall notify the Covered Entity with the following information, to the extent possible, as soon as it becomes available: (i) identification of each individual whose Unsecured PHI has been, or is reasonably believed to have been Breached; (ii) a brief description of the Breach, including the type of Breach(e.g.,theft, loss, improper disposal,hacking),location of the Breach (e.g., laptop, desktop, paper), how the Breach occurred, the date the Breach occurred and the date the Breach was discovered,if known; Business Associate Agreement 5