Common use of Reporting of Security Incidents Clause in Contracts

Reporting of Security Incidents. DELOITTE will report to ETF any security incident of which DELOITTE becomes aware, that directly and materially involves member information, within three (3) business days after becoming aware of the incident. For the purposes of this subsection, a “security incident” that “directly and materially” involves member information means that the incident involves direct access to Personal Information, Individual Personal Information, Medical Records, or Protected Health Information that is not allowed by this Addendum or that violates 45 C.F.R. Part 164.