BMI Audit Services LLC 2/22/2019

BMI Audit Services (iii) a description of the type of Unsecured .PHI involved (e.g., social security number, diagnosis, or disability code), including the type of media, but not the Breached PHI itself; (iv) a description of the safeguards in place prior to the Breach (e.g., firewalls, packet filtering, secure browser sessions, strong authentication); and (v) a description of the actions taken in response to the Breach (e.g., additional safeguards, mitigation, sanctions, policies and procedures). (d) Notification to Individuals . When a Business Associate discovers a Breach of Unsecured PHI that occurs while the Business Associate is responsible for the privacy and security of the information, the Covered Entity shall notify each affected individual in accordance with the requirements of 45 C.F.R. § 164.404. (e) Notification to Media. When a Business Associate discovers a Breach of Unsecured PHI affecting more than 500 individuals that occurs while the Business Associate is responsible for the privacy and security of the information, the Covered Entity shall provide a notice in the form of a press release to a prominent media outlet in accordance with the requirements of 45 C.F.R. § 164.406. (0 Documentation and Retention. The Business Associate must retain a copy of all risk assessment documentation and notifications created or sent in compliance with this Section 3.14 for six years. Upon request, the Business Associate shall provide to the Plan a copy of any documentation or notification created or sent in compliance with this Section 3.14 that was not previously required to be provided to the Covered Entity. 3.15 Sale of PHI. Business Associate is prohibited from exchanging PHI for direct or indirect remuneration without obtaining the individual's authorization. 3.16 Compliance. Business Associate shall make its internal practices, books, and records, including policies and procedures relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity, documentation required by the Security Rule relating to safeguards,and documentation required by the Breach Notification Rule available to Covered Entity, or to the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule, Security Rule, and Breach Notification Rule. 3.17 Compliance With.E ectrotic Transactions Rule. If Business Associate conducts in whole or part electronic Transactions on behalf of Covered Entity for which HHS has established standards, Business Associate will comply, and will require any of its own subcontractors it involves with the conduct of such Transactions to comply,with each applicable requirement of the Electronic Transactions Rule and of any operating rules adopted by HHS with respect to Transactions. Business Associate Agreement 6