Orange County NC Website
Browse       Search
37 <br /> 2. To include in the above-described notification the names of the individuals whose <br /> Unsecured PHI has been, or is reasonably believed to have been, the subject of a breach. <br /> 3. To provide a draft letter to Covered Entity to utilize to notify the individuals that their <br /> Unsecured PHI has been, or is reasonably believed to have been, the subject of a breach. <br /> The draft letter must include,to the extent possible: <br /> a. A brief description of what happened, including the date of the breach and the date of <br /> the discovery of the breach, if known; <br /> b. A description of the types of Unsecured PHI that were involved in the breach (such as <br /> full name, Social Security Number, date of birth, home address, account number, <br /> disability code, or other types of information that were involved); <br /> c. Any steps the individuals should take to protect themselves from potential harm <br /> resulting from the breach: <br /> d. A brief description of what Covered Entity and Business Associate are doing to <br /> investigate the breach,to mitigate losses, and to protect against any further breaches; <br /> and <br /> e. Contact information for individuals to ask questions or learn additional information, <br /> which shall include a toll-free telephone number, an email address,web site, or postal <br /> address. <br /> III.TERMINATION <br /> A. This Addendum will terminate automatically, without further action by either party, upon <br /> termination of the Agreement to which it is attached. <br /> B. Covered Entity may terminate this Addendum if Covered Entity determines that Business <br /> Associate has violated a material term of the Agreement or this Addendum. <br /> C. Upon Covered Entity's gaining knowledge of a breach, as defined by North Carolina State Law or <br /> HIPAA, by Business Associate or any of its agents or subcontractors, of the Agreement or this <br /> Addendum, Covered Entity shall either: <br /> 1. Provide an opportunity for Business Associate to cure the breach or end the violation, and if <br /> Business Associate does not cure the breach or end the violation within the time specified <br /> by Covered Entity,terminate this Addendum and the attached Agreement; or <br /> 2. Immediately terminate this Addendum and the attached Agreement if either has been <br /> breached by a Business Associate, and a cure is not possible. <br /> D. In situations where it is not practicable to terminate this Agreement, Covered Entity shall report <br /> Business Associate's breach as defined by North Carolina State Law or HIPAA to the Secretary of <br /> DHHS, and continue under the existing arrangement with Business Associate until a reasonable <br /> alternative becomes available, or until directed by the Secretary of DHHS to terminate the <br /> Agreement. <br /> E. At termination of the attached Agreement and this Addendum, or upon request of Covered <br /> Entity, whichever occurs first, Business Associate shall: <br /> 1. If feasible, return or destroy all PHI that Business Associate still maintains in any form, <br /> received from Covered Entity or created, maintained or received by Business Associate on <br /> behalf of Covered Entity. Business Associate shall only destroy PHI with the written approval <br /> of Covered Entity. After return or destruction, Business Associate shall retain no copies of <br /> such information. <br /> 2. If return or destruction is not feasible, Business Associate will provide Covered Entity with <br /> documentation explaining the reason it is not feasible. If the PHI is not returned or <br /> destroyed, Business Associate will extend the protection of this Addendum to the <br /> 13 <br />