Page 7 of 9
July 2017
remediation relating to notification required by law for individuals whose PHI or personal information
have been inappropriately accessed or disclosed.
6.2. In the event that either party is required by law to notify individuals whose PHI was
inappropriately accessed, used, or disclosed by Subcontractor or its agents, and the PHI contains (i) the
individual’s first initial or first name, last name, and social security number; (ii) the individual’s first initial
or first name, last name, and driver’s license or state identification card; (iii) the individual’s first initial
or first name, last name, account number, credit or debit card number, in combination with any
required security code, access code, or password that would permit access to an individual's financial
account; or (iv) any information which under federal or state law requires that credit monitoring be
provided, then Subcontractor and Business Associate shall work together to structure a credit
monitoring offering commensurate to the risk posed by the breach. All costs and expenses of such credit
monitoring and required notification shall be paid by Subcontractor, and the credit monitoring will
extend for a minimum of one (1) year or longer as determined by Business Associate. In the event of a
Breach of PHI by Subcontractor or one of its agents, Subcontractor will also be responsible for paying all
costs, including legal fees, incurred in assuring compliance with the law with respect to such Breach.
7. Insurance. Subcontractor shall obtain insurance for itself and all its employees, agents and
independent contractors in an amount not less than One Million Dollars ($1,000,000) per occurrence
and Three Million Dollars ($3,000,000) annual aggregate of Commercial General Liability insurance and
One Million Dollars ($1,000,000) per occurrence and Three Million Dollars ($3,000,000) annual
aggregate of Errors and Omissions insurance. The Errors and Omissions insurance shall cover, among
other things, Breaches. Subcontractor shall name Business Associate as an “additional insured”.
Subcontractor shall provide Business Associate with certificates of insurance or other written evidence
of the insurance policy or policies required herein prior to execution of this Agreement and other
agreements between the Parties (or as shortly thereafter as is practicable) and as of each annual
renewal of such insurance policies during the period of such coverage. Further, in the event of any
modification, termination, expiration, non-renewal, or cancellation of any of such insurance policies,
Subcontractor shall give written notice thereof to Business Associate not more than ten (10) days
following Subcontractor’s receipt of such notification. In the event Subcontractor fails to procure,
maintain, or pay for the insurance required under this section, Business Associate shall have the right,
but not the obligation, to obtain such insurance. Should that occur, Subcontractor shall promptly upon
written request (within 14 days) reimburse Business Associate for the cost of the insurance, and failure
to repay the cost with 14 days upon demand by Business Associate shall constitute a material violation
of this Agreement and other agreements between the Parties.
8. No Third-Party Beneficiary. The provisions and covenants set forth in this Agreement are
expressly entered into only by and between Subcontractor and Business Associate, and are only for their
benefit. Neither Subcontractor nor Business Associate intends to create or establish any third party
beneficiary status or right (or the equivalent thereof) in any other third party and no such third party
shall have any right to enforce or enjoy any benefit created or established by the provisions and
covenants in this Agreement.
9. Amendment. The parties agree to promptly modify or amend this Agreement to permit Business
Associate to comply with any new laws, rules, or regulations that might modify the terms and conditions
herein.
