Common use of Procedure for Internal Reporting Clause in Contracts

Procedure for Internal Reporting. 21CO shall require all members of its workforce who have access to ePHI to report to the CR at the earliest possible time any violation of 21CO’s policies and procedures related to the HIPAA Rules of which they become aware. Within sixty (60) days of HHS’s approval of the CR’s Internal Monitoring Plan, 21CO shall develop a written procedure for such reporting (“Internal Reporting Procedure”) and shall submit the Internal Reporting Procedure to HHS for its comment and approval. The review and approval process of the Internal Reporting Procedure shall be identical to that of the Internal Monitoring Plan, as set out in this CAP. While the CAP is in effect, 21CO may determine from time to time to revise or amend the Internal Reporting Procedure; such revisions or amendments may only take effect after the CR has presented them to HHS for review and approval and made any changes that HHS may reasonably request. Pursuant to the Internal Reporting Procedure, whenever 21CO or the CR learns that a member of its workforce may have violated 21CO’s policies and procedures related to the HIPAA Rules, the CR, with the full cooperation of 21CO, shall promptly investigate the allegations raised and shall document each investigation in writing. If 21CO determines that a member of its workforce has failed to comply with 21CO’s policies and procedures related to the HIPAA Rules, the CR shall notify both the Assessor and HHS in writing of the finding within thirty (30) days of such determination. Such violation findings shall be known as “Reportable Events.” The CR’s written report to HHS and the Assessor shall include the following information: a. A complete description of the Reportable Event, including the relevant facts, the persons involved, the date, time and place on which the events occurred, and the provision(s) of the implicated requirement; and b. A description of the actions taken by 21CO and/or the CR to mitigate any harm and any further steps that they plan to take to address the problems that gave rise to the violation(s) and prevent them from recurring.

Procedure for Internal Reporting. 21CO CHSPSC shall require all members of its workforce who have access to ePHI to report to the CR at the earliest possible time any violation of 21COCHSPSC’s policies and procedures related to the HIPAA Rules approved by HHS under Section V.C, of which they become aware. Within sixty (60) days of HHS’s approval of the CR’s Internal Monitoring PlanEffective Date, 21CO CHSPSC shall develop a written procedure for such reporting (“Internal Reporting Procedure”) and shall submit the Internal Reporting Procedure to HHS for its comment and approval. The review and approval process of the Internal Reporting Procedure shall be identical to that of the Internal Monitoring Plan, as set out in this CAP. While the CAP is in effect, 21CO CHSPSC may determine from time to time to revise or amend the Internal Reporting Procedure; such revisions or amendments may only take effect after the CR has presented them to HHS for review and approval and made any changes that HHS may reasonably request. Pursuant to the Internal Reporting Procedure, whenever 21CO CHSPSC or the CR learns that a member of its workforce may have violated 21COCHSPSC’s policies and procedures related to the HIPAA Rulesapproved by HHS under Section V.C, the CR, with the full cooperation of 21COCHSPSC, shall promptly investigate the allegations raised and shall document each investigation in writing. If 21CO CHSPSC determines that a member of its workforce has failed to comply with 21COCHSPSC’s policies and procedures related to the HIPAA Rulesapproved by HHS under Section V.C, and such failure was material (e.g., a violation that results in a presumed Breach of Unsecured PHI), the CR shall notify both the Assessor and HHS in writing of the finding within thirty (30) days of such determination. Such violation findings shall be known as “Reportable Events.” The CR’s written report to HHS and the Assessor shall include the following information: a. A complete description of the Reportable Event, including the relevant facts, the persons involved, the date, time and place on which the events occurred, and the provision(s) of the implicated requirement; and b. A description of the actions taken by 21CO CHSPSC and/or the CR to mitigate any harm and any further steps that they plan to take to address the problems that gave rise to the violation(s) and prevent them from recurringfromrecurring.