Common use of BREACH DISCOVERY AND NOTIFICATION Clause in Contracts

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 twenty four (24) hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach; 1 b. Any other information that COUNTY is required to include in the notification to 2 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 3 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 4 period set forth in 45 CFR § 164.410 (b) has elapsed, including:

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 25 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 26 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 27 law enforcement official pursuant to 45 CFR § 164.412. 26 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 30 known to CONTRACTOR. 29 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 36 notification within 24 hours of the oral notification. 35 37 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 25 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 26 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 27 law enforcement official pursuant to 45 CFR § 164.412. 26 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 30 known to CONTRACTOR. 29 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 36 notification within 24 twenty four (24) hours of the oral notification. 35 37 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 twenty-four (24) hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 25 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 26 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 25 27 law enforcement official pursuant to 45 CFR § 164.412. 26 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 30 known to CONTRACTOR. 29 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 36 notification within 24 hours of the oral notification. 35 37 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. 5.01 Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 COUNTY CITY of such Breach, however however, both parties may agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § §164.412. 26 a. 5.01.1 A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. 5.01.2 CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have been known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by the federal common law of agency. 32 2. 5.02 CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CITY DEH Executive Director or other designee. 5.02.1 CONTRACTOR’s 'S initial notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. 5.03 CONTRACTOR’s 'S notification shall include, to the extent possible: 36 a. 5.03.l The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 25 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 24 26 COUNTY of such Breach, however both parties Parties agree to a delay in the notification if so advised by a 25 27 law enforcement official pursuant to 45 CFR § 164.412. 26 28 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 29 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 30 known to CONTRACTOR. 29 31 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 32 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 33 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 34 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 35 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 36 notification within 24 hours of the oral notification. 35 37 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a ▇ 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;

BREACH DISCOVERY AND NOTIFICATION. 23 1. Following the discovery of a Breach of Unsecured PHIPHI , CONTRACTOR shall notify 24 COUNTY of such Breach, however both parties Parties agree to a delay in the notification if so advised by a 25 law enforcement official pursuant to 45 CFR § 164.412. 26 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 27 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 28 known to CONTRACTOR. 29 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 30 known, or by exercising reasonable diligence would have known, to any person who is an employee, 31 officer, or other agent of CONTRACTOR, as determined by federal common law of agency. 32 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 33 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 34 notification within 24 hours five (5) business days of the oral notification. 35 3. CONTRACTOR’s notification shall include, to the extent possible: 36 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 37 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;