What must a Degree Wellness Business Associate do if they become aware of a breach of unsecured PHI?
Degree_Wellness Franchise · 2025 FDDAnswer from 2025 FDD Document
documentation requirements of
the HIPAA Security Rule, including, but not limited to, 45 C.F.R. §§ 164.308, 164.310, 164.312, 164.314 and 164.316.
- (f) Reporting of Unauthorized Uses or Disclosures and Security Incidents. Business Associate agrees to report to Covered Entity in writing any access, use or disclosure of PHI not provided for or permitted by this Agreement and, any Security Incidents of which Business Associate (or Business Associate's employee, officer or agent) becomes aware. Business Associate shall so notify Covered Entity pursuant to this Section 3(f) within twenty-four (24) hours after Business Associate becomes aware of such unauthorized use, disclosure or Security Incident.
- (g) Reporting of Breach of Unsecured PHI. Business Associate agrees to report to Covered Entity any Breach of Unsecured PHI of which Business Associate (or Business Associate's employee, officer or agent) becomes aware without unreasonable delay and in no case later than twenty-four (24) hours after Business Associate knows of such Breach, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security.
- (h) Agents and Subcontractors.
Source: Item 23 — Receipts (FDD pages 66–257)
What This Means (2025 FDD)
According to Degree Wellness's 2025 Franchise Disclosure Document, a Business Associate who becomes aware of a breach of unsecured Protected Health Information (PHI) must report it to the Covered Entity. This report must be made without unreasonable delay, and in no case later than 24 hours after the Business Associate knows of the breach. An exception to this rule exists if a law enforcement official determines that such notification would impede a criminal investigation or cause damage to national security.
In addition to reporting the breach, the Degree Wellness Business Associate is obligated to mitigate, to the extent practicable, any harmful effect resulting from the use or disclosure of PHI by the Business Associate or its agents or subcontractors in violation of the agreement. This means taking active steps to minimize any negative consequences stemming from the breach.
Furthermore, the Business Associate must ensure that any agent, including a subcontractor, who is provided with PHI agrees in writing to the same restrictions and conditions that apply to the Business Associate. This includes implementing the necessary safeguards to protect electronic PHI (ePHI). If the Business Associate knows of a pattern of activity or practice of an agent that violates these obligations, the Business Associate must take reasonable steps to end the violation, and if unsuccessful, terminate the arrangement if feasible. These requirements are designed to ensure a multi-layered approach to protecting sensitive health information, with clear lines of responsibility and accountability at each level.