HIPAA and BAAs — Incidents & breach notification (2)

Breaches of Unsecured PHI. Business Associate will notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and in no event later than fifteen (15) business days after discovery, in accordance with 45 C.F.R. § 164.410. The notice will include, to the extent known or subsequently learned: the identity of each Individual whose Unsecured PHI was or is reasonably believed to have been involved; a description of what happened, the dates of the Breach and its discovery; the types of information involved; steps Individuals should take to protect themselves; and what Business Associate is doing to investigate, mitigate and prevent recurrence. Business Associate will supplement the notice as new information becomes available and will cooperate with Covered Entity's own notification obligations under 45 C.F.R. §§ 164.404–164.408.