1. (a) Scope and applicability. This policy applies to the Office of Health Information Technology, all participating entities, and their BAs and contractors.

2. (b) Duty to mitigate.

   1. (1) Each participating entity shall implement a process to mitigate, and shall mitigate and take appropriate remedial action against, any harmful effect that is known to the participating entity of a use or disclosure of protected health information through the State Health Alliance for Records Exchange that is in violation of applicable laws and/or rules and/or these policies by the participating entity or its workforce members, agents, and contractors.
   2. (2) Steps to mitigate could include, among other things, participating entity notification to the individual of the disclosure of information about them, or participating entity request to the party who improperly received such information to return or destroy impermissibly disclosed information.

3. (c) Duty to cooperate.

   1. (1) A participating entity that has caused or contributed to a privacy breach or that could assist with mitigation of the effects of a breach shall cooperate with the office and with another participating entity that has the primary obligation to mitigate a breach.
   2. (2) This obligation exists whether the participating entity is directly responsible or whether the breach was caused or contributed to by members of the participating entity’s workforce or by its BAs or contractor or their workforce.

4. (d) Notification to the office.

   1. (1) A participating entity primarily responsible to mitigate shall notify the office Privacy Officer of all events requiring mitigation and of all actions taken to mitigate.
   2. (2) The office may facilitate the mitigation process if asked.
   3. (3) The office shall provide training on breach mitigation.
5. (e) Application to BAs and contractors. Participating entities shall make this policy applicable to their BAs and to the contractors and subcontractors of their BAs as they deem appropriate through the terms of their BA agreements.

Codification Notes: “BA” means business associate.