HIPAA and BAAs — Incidents & breach notification

Security Incidents. Business Associate will report to Covered Entity any successful Security Incident involving PHI of which it becomes aware within ten (10) business days. The parties acknowledge the ongoing existence of unsuccessful attempts — pings, port scans, denied log-in attempts and comparable events that do not result in unauthorized access, use or disclosure — and agree that this paragraph constitutes notice of them, with no further reporting required.