What are some examples of 'unsuccessful Security Incidents' that Dermani Medspa's Business Associate does not have to report?
Dermani_Medspa Franchise · 2025 FDDAnswer from 2025 FDD Document
Notwithstanding the foregoing, the Parties acknowledge and agree that Business Associate need not report all attempted but unsuccessful Security Incidents to Covered Entity, and that this Agreement constitutes notice to Covered Entity that such unsuccessful Security Incidents occur periodically.
Unsuccessful Security Incidents include, but are not limited to, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as such incidents do not result in actual unauthorized access, use, or disclosure of PHI.
Source: Item 23 — RECEIPTS (FDD pages 66–311)
What This Means (2025 FDD)
According to the 2025 Dermani Medspa Franchise Disclosure Document, the Business Associate does not need to report all attempted but unsuccessful security incidents to the Covered Entity, as these incidents occur periodically. Examples of unsuccessful security incidents include pings and other broadcast attacks on the Business Associate's firewall, port scans, unsuccessful log-on attempts, and denials of service. These incidents do not require reporting as long as they do not result in actual unauthorized access, use, or disclosure of Protected Health Information (PHI).
This means that Dermani Medspa's Business Associate is only obligated to report security breaches that lead to unauthorized access, use, or disclosure of PHI. The agreement acknowledges that unsuccessful attempts are common and do not warrant individual reporting, streamlining the reporting process and focusing on actual breaches of sensitive information.
For a prospective Dermani Medspa franchisee, this clause in the agreement clarifies the scope of security incident reporting required of their Business Associate. It is important for franchisees to understand the distinction between attempted and successful security incidents to ensure compliance with reporting obligations and to manage potential risks effectively. Franchisees should also confirm that their Business Associate has adequate security measures in place to prevent unsuccessful attempts from turning into successful breaches.