SH22-011 - WA STATE HCA MOUD IN JAILS PSA - Amendment 1 - partially executed

Home Browse Search

d. The investigative and remedial actions the Contractor or its Subcontractor took or will take to prevent and mitigate harmful effects and protect against recurrence; e. Any details necessary for a determination of the potential harm to Clients whose PHI is believed to have been Used or disclosed and the steps those Clients should take to protect themselves; and f. Any other information HCA reasonably requests. 10.3. The Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or HCA including but not limited to 45 C.F.R. Part 164 Subpart D; RCW 42.56.590; RCW 19.255.010; or WAC 284-04-625. 10.4. If notification must, in the sole judgement of HCA, must be made Contractor will further cooperate and facilitate notification to necessary individuals, to the U.S. Department of Health and Human Services (DHHS) Secretary, and to the media. At HCA's discretion, Contractor may be required to directly perform notification requirements, or if HCA elects to perform the notifications, Contractor must reimburse HCA for all costs associated with notification (s). 10.5. Contractor is responsible for all costs incurred in connection with a security incident privacy Breach, or potential compromise of Data, including: a. Computer forensics assistance to assess the impact of a Data Breach, determine root cause, and help determine whether and the extent to which notification must be provided to comply with Breach notification laws; b. Notification and call center services for individuals affected by a security incident or privacy Breach, including fraud prevention, credit monitoring, and identify theft assistance; and c. Regulatory defense, fines, and penalties from any claim in the form of a regulatory proceeding resulting from a violation of any applicable privacy or security law(s) or regulation(s). 10.6. Any breach of this section may result in termination of the Contract and the demand for return or disposition, as described in Section 7.3, of all HCA Data. 10.7. Contractor's obligations regarding breach notification survive the termination of this Contract and continue for as long as Contractor maintains the Data and for any Breach or potential compromise, 11. Privacy Breach Response Coverage Requirements For the term of this Contract and 3 years following its termination or expiration, Contractor must maintain insurance to cover costs incurred in connection with a security incident, privacy Breach, or potential compromise of Data, including: a. Computer forensics assistance to assess the impact of a Data Breach, determine root cause, and help determine whether and the extent to which notification must be provided to comply with Breach notification laws; b. Notification and call center services for individuals affected by a security incident, or privacy Breach; Washington State Health Care Authority Page 13 HCA Contract No. K5885-1