Laserfiche WebLink
which it becomes aware which potentially compromises the security or privacy of the <br />Protected Health Information as defined in 45 CFR 164.402 (Definitions). <br />c. Business Associate will notify the DSHS Contact shown on the cover page of this <br />Contract within one (1) business day by telephone or e-mail of any potential Breach of <br />security or privacy of PHI by the Business Associate or its Subcontractors or <br />agents. Business Associate will follow telephone or e-mail notification with a faxed or <br />other written explanation of the Breach, to include the following: date and time of the <br />Breach, date Breach was discovered, location and nature of the PHI, type of Breach, <br />origination and destination of PHI, Business Associate unit and personnel associated <br />with the Breach, detailed description of the Breach, anticipated mitigation steps, and the <br />name, address, telephone number, fax number, and e-mail of the individual who is <br />responsible as the primary point of contact. Business Associate will address <br />communications to the DSHS Contact. Business Associate will coordinate and <br />cooperate with DSHS to provide a copy of its investigation and other information <br />requested by DSHS, including advance copies of any notifications required for DSHS <br />review before disseminating and verification of the dates notifications were sent. <br />d. If DSHS determines that Business Associate or its Subcontractor(s) or agent(s) is <br />responsible for a Breach of unsecured PHI: <br />(1) requiring notification of Individuals under 45 CFR § 164.404 (Notification to <br />Individuals), Business Associate bears the responsibility and costs for notifying the <br />affected Individuals and receiving and responding to those Individuals' questions or <br />requests for additional information; <br />(2) requiring notification of the media under 45 CFR § 164.406 (Notification to the <br />media), Business Associate bears the responsibility and costs for notifying the <br />media and receiving and responding to media questions or requests for additional <br />information; <br />(3) requiring notification of the U.S. Department of Health and Human Services <br />Secretary under 45 CFR § 164.408 (Notification to the Secretary), Business <br />Associate bears the responsibility and costs for notifying the Secretary and <br />receiving and responding to the Secretary's questions or requests for additional <br />information; and <br />(4) DSHS will take appropriate remedial measures up to termination of this Contract. <br />9. Miscellaneous Provisions. <br />a. Regulatory References. A reference in this Contract to a section in the HIPAA Rules <br />means the section as in effect or amended. <br />b. Interpretation. Any ambiguity in this Contract shall be interpreted to permit compliance <br />with the HIPAA Rules. <br />Washington State <br />Health Care Authority Page 58 of90 HCA Contract No . K3924