25A - AGMT EMPLOYEE TRACKING SVCS

Home Browse Search

164.410, and any Security Incident of which it becomes aware. The Business Associate will make the report to the Covered Entity's Privacy Official not more than twenty-five (25) calendar days after the Business Associate becomes aware of such non -permitted use or disclosure. If a delay is requested by a law-enforcement official in accordance with 45 CFR §164.412, the Business Associate may delay notifying the Covered Entity for the applicable time period. The Business Associate's report will at least: (A) Identify the nature of the Breach or other non -permitted use or disclosure, which will include a brief description of what happened, including the date of any Breach and the date of the discovery of the Breach; (B) Identify the Covered Entity's Protected Health Information that was subject to the non -permitted use or disclosure or Breach (such as whether full name, social security number, date of birth, home address, account number or other information were involved) on an Individual basis; (C) Identify who made the non -permitted use or disclosure and who received the non -permitted use or disclosure; (D) Identify what corrective or Investigational action the Business Associate took or will take to prevent further non -permitted uses or disclosures, to mitigate harmful effects and to protect against any further Breaches; (E) Identify what steps the Individuals who were subject to a Breach should take to protect themselves; and (F) Provide such other Information, including a written report and risk assessment under 45 CFR §164.402, as the Covered Entity may reasonably request, (iii) Security Incidents. The Business Associate will report to The Covered Entity any Security Incident of which the Business Associate becomes aware. The Business Associate will make this report once per month, except If any such Security Incident resulted in a disclosure not permitted by this Agreement or Breach of Unsecured Protected Health Information, Business Associate will make the report in accordance with the provisions set forth above, (b) Mitigation. The Business Associate shall mitigate, to the extent practicable, any harmful effect known to the Business Associate resulting from a use or disclosure in violation of this Agreement. VIII. Term and Termination (a) Tenn. The term of this Agreement shall be effective as of the date specified below, and shall terminate when all Protected Health Information provided by the Covered Entity to the Business Associate, or created or received by the Business Associate on behalf of the Covered Entity, is destroyed or returned to the Covered Entity, or, if It Is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this section. (b) Right to Terminate for Cause. The Covered Entity may terminate this Agreement if it determines, in its sole discretion that the Business Associate has breached a material term of this Agreement, and upon written notice to the Business Associate of the breach, the Business Associate fails to cure the breach within thirty (30) calendar days after receipt of the notice. Any such termination will be effective Immediately or at such other date specified in the Covered Entity's notice of termination. (c) Treatment of Protected Health Information on Termination. (i) Return or Destruction of Covered Entity's Protected Health Information as Feasible. Upon termination or other conclusion of this Agreement, the Business Associate will, if feasible, return to the Covered Entity or destroy all of the Covered Entity's Protected Health Information in whatever form or medium, Including all copies thereof and all data, compilations, and other works derived there from that allow Identification of any Individual who Is a subject of the Covered Entity's Protected Health Information. This provision shall apply to Protected Health Information that is In the possession of Subcontractors or agents of the Business Associate. Further, the Business Associate shall require any such Subcontractor or agent to certify to the Business Associate that It returned to the Business Associate (so that the Business Associate may return it to the Covered Entity) or destroyed all such information which could be returned or destroyed. The Business 25A-18