Orange County NC Website
Browse       Search
135 <br /> incident within the above timeframe even if Business Associate has not conclusively <br /> determined within that time that the incident constitutes a breach as defined by <br /> HIPAA. For purposes of this Addendum, Business Associate is deemed to have <br /> become aware of the breach as of the first day on which such breach is known or <br /> reasonably should have been known to such entity or associate of Business Associate, <br /> including any person, other than the individual committing the breach, that is an <br /> employee, officer or other agent of Business Associate or an associate of Business <br /> Associate. <br /> 2. To include in the above-described notification the names of the individuals whose <br /> Unsecured PHI has been, or is reasonably believed to have been, the subject of a <br /> breach. <br /> 3. To provide a draft letter to Covered Entity to utilize to notify the individuals that their <br /> Unsecured PHI has been, or is reasonably believed to have been, the subject of a <br /> breach. The draft letter must include, to the extent possible: <br /> a. A brief description of what happened, including the date of the breach and the <br /> date of the discovery of the breach, if known; <br /> b. A description of the types of Unsecured PHI that were involved in the breach <br /> (such as full name, Social Security Number, date of birth, home address, account <br /> number, disability code, or other types of information that were involved); <br /> c. Any steps the individuals should take to protect themselves from potential harm <br /> resulting from the breach: <br /> d. A brief description of what Covered Entity and Business Associate are doing to <br /> investigate the breach, to mitigate losses, and to protect against any further <br /> breaches; and <br /> e. Contact information for individuals to ask questions or learn additional <br /> information, which shall include a toll-free telephone number, an email address, <br /> web site, or postal address. <br /> lIl. TERMINATION <br /> A. This Addendum will terminate automatically,without further action by either party,upon <br /> termination of the Agreement to which it is attached. <br /> B. Covered Entity may terminate this Addendum if Covered Entity determines that Business <br /> Associate has violated a material term of the Agreement or this Addendum. <br /> C. Upon Covered Entity's gaining knowledge of a breach, as defined by North Carolina <br /> State Law or HIPAA,by Business Associate or any of its agents or subcontractors, of the <br /> Agreement or this Addendum, Covered Entity shall either: <br /> 1. Provide an opportunity for Business Associate to cure the breach or end the violation, <br /> and if Business Associate does not cure the breach or end the violation within the <br /> time specified by Covered Entity, terminate this Addendum and the attached <br /> Agreement; or <br /> 2. Immediately terminate this Addendum and the attached Agreement if either has been <br /> breached by a Business Associate, and a cure is not possible. <br /> D. In situations where it is not practicable to terminate this Agreement, Covered Entity shall <br /> report Business Associate's breach as defined by North Carolina State Law or HIPAA to <br /> the Secretary of DHHS, and continue under the existing arrangement with Business <br /> 3 <br />