Orthopedic Clinic Pays $1.5 Million to Settle Systemic Noncompliance with HIPAA Rules

RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 1 of 14 RESOLUTION AGREEMENT I. Recitals 1. Parties. The Parties to this Resolution Agreement (Agreement) are A. The United States Department of Health and Human Services, Office for Civil Rights (“HHS” or “OCR”), which enforces the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”), the Federal standards that govern the security of electronic individually identifiable health information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the “Security Rule”), and the Federal standards for notification in the case of breach of unsecured protected health information (45 C.F.R. Part 160 and Subparts A and D of 45 C.F.R. Part 164, the “Breach Notification Rule”). HHS has the authority to conduct compliance reviews and investigations of complaints alleging violations of the Privacy, Security, and Breach Notification Rules (the “HIPAA Rules”) by covered entities and business associates, and covered entities and business associates must cooperate with HHS compliance reviews and investigations. See 45 C.F.R. §§ 160.306(c), 160.308, and 160.310(b). B. Athens Orthopedic Clinic PA (“AOC”), which is a covered entity, as defined at 45 C.F.R. § 160.103, and therefore is required to comply with the HIPAA Rules. Since 1966, AOC provides orthopedic services to patients across Northeast Georgia. It employs approximately 398 people and serves approximately 138,000 patients annually. HHS and AOC shall together be referred to herein as the “Parties.” 2. Factual Background and Covered Conduct. On June 26, 2016, a journalist from “www.databreaches.net” notified AOC that “a database of patient records” suspected to belong to AOC was posted online for sale. On June 28, 2016, a hacker group known as “The Dark Overlord” contacted AOC by email and demanded money in return for a complete copy of the database it stole without sale or further disclosure. It was determined, through computer forensic analysis, that the Dark Overlord had obtained a vendor’s credentials to AOC’s system and used them to gain access on June 14, 2016. While AOC terminated the compromised credentials on June 27, 2016, the Dark Overlord’s continued intrusion was not effectively blocked until July 16, 2016. It was determined that 208,557 individuals were affected by this breach. Due to the breadth of system applications affected, a variety of protected health information (PHI) was exposed including patient demographic information (name, date of birth, social security number, etc.), clinical information (reason for visit, “social history,” medications, test results, medical procedures, etc.), and financial/billing information (health insurance information, payment history). RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 2 of 14 OCR's investigation indicated potential violations of the following provisions of the HIPAA Rules ("Covered Conduct"): A. The requirement to prevent unauthorized access to the ePHI of 208,557 individuals whose information was maintained in AOC's information systems. (See 45 C.F.R. §164.502(a)). B. Until August 2016, the requirement to maintain copies of AOC’s HIPAA policies and procedures. See 45 C.F.R. § 164.530(i) and (j). C. From September 30, 2015 to December 15, 2016, the requirement to implement sufficient hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. See 45 C.F.R. §§ 164.312(b). D. Until August 7, 2017, the requirement to enter into business associate agreements with three of its business associates, Quest Records LLC, Total Technology Solutions, and SRS Software LLC. See 45 C.F.R. § 164.308(b)(3). E. Until January 15, 2018, the requirement to provide its entire workforce with HIPAA training. See 45 C.F.R. § 164.530(b). F. The requirement to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by AOC. See 45 C.F.R. § 164.308(a)(1)(ii)(A). G. The requirement to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. See 45 C.F.R. § 164.308(a)(1)(ii)(B). 3. No Admission. This Agreement is not an admission, concession, or evidence of liability by AOC. 4. No Concession. This Agreement is not a concession by HHS that AOC is not in violation of the HIPAA Rules and that AOC is not liable for civil money penalties. 5. Intention of Parties to Effect Resolution. This Agreement is intended to resolve HHS Transaction Number 16-245007 and any violations of the HIPAA Rules related to the Covered Conduct specified in Section I, Paragraph 2 of this Agreement. In consideration of the Parties’ interest in avoiding the uncertainty, burden, and expense of further investigation and formal proceedings, the Parties agree to resolve this matter according to the Terms and Conditions below. II. Terms and Conditions 1. Payment. AOC agrees to pay to HHS the amount of $1,500,000 (“Resolution Amount”). AOC agrees to pay the Resolution Amount on or before August 7, 2020 by automated clearing house transaction pursuant to written instructions to be provided by HHS. 2. Corrective Action Plan. AOC has entered into and agrees to comply with the Corrective Action RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 3 of 14 Plan (“CAP”), attached as Appendix A, which is incorporated into this Agreement by reference. If AOC breaches the CAP, and fails to cure the breach as set forth in the CAP, then AOC will be in breach of this Agreement and HHS will not be subject to the Release set forth in Section II, Paragraph 3 of this Agreement. 3. Release by HHS. In consideration and conditioned upon AOC’s performance of its obligations under this Agreement, HHS releases AOC from any actions it may have against AOC under the HIPAA Rules for the Covered Conduct identified in Section I, Paragraph 2. HHS does not release AOC from, nor waive any rights, obligations, or causes of action other than those specifically referred to in that paragraph. This release does not extend to actions that may be brought under section 1177 of the Social Security Act, 42 U.S.C. § 1320d-6. 4. Agreement by Released Parties. AOC shall not contest the validity of its obligations to pay, nor the amount of, the Resolution Amount or any other obligations agreed to under this Agreement. AOC waives all procedural rights granted under Section 1128A of the Social Security Act (42 U.S.C. § 1320a- 7a) and 45 C.F.R. Part 160 Subpart E and HHS Claims Collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice, hearing, and appeal with respect to the Resolution Amount. 5. Binding on Successors. This Agreement is binding on AOC and its successors, heirs, transferees, and assigns. 6. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement. 7. No Additional Releases. This Agreement is intended to be for the benefit of the Parties only, and by this instrument the Parties do not release any claims against or by any other person or entity. 8. Effect of Agreement. This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement shall be set forth in writing and signed by all Parties. 9. Execution of Agreement and Effective Date. The Agreement shall become effective (i.e., final and binding) upon the date of signing of this Agreement and the CAP by the last signatory (“Effective Date”). 10. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a-7a(c)(1), a civil money penalty (“CMP”) must be imposed within six (6) years from the date of the occurrence of the violation. To ensure that this six-year period does not expire during the term of this agreement, AOC agrees that the time between the Effective Date of this Agreement (as set forth in Section II, Paragraph 9) and the date the Resolution Agreement may be terminated by reason of AOC’s breach, plus one-year thereafter, will not be included in calculating the six (6) year statute of limitations applicable to the violations which are the subject of this agreement. AOC waives and will not plead any statute of limitations, laches, or similar defenses to any administrative action relating to the Covered Conduct identified in Paragraph 2 of Section I that is filed by HHS within the time period set forth above, except to the extent that such defenses would have been RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 4 of 14 available had an administrative action been filed on the Effective Date of this Resolution Agreement. 11. Disclosure. HHS places no restriction on the publication of the Agreement. This Agreement and information related to this Agreement may be made public by either Party. In addition, HHS may be required to disclose this Agreement and related material to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. §552, and its implementing regulations, 45 C.F.R. Part 5. 12. Execution in Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. 13. Authorizations. The individual(s) signing this Agreement on behalf of AOC represent and warrant that they are authorized by AOC to execute this Agreement. The individual(s) signing this Agreement on behalf of HHS represent and warrant that they are signing this Agreement in their official capacities and that they are authorized to execute this Agreement. For Athens Orthopedic Clinic PA /s/ 7/6/2020 ___________________________ ____________________ Kayo Elliot Date Chief Executive Officer Athens Orthopedic Clinic PA For the United States Department of Health and Human Services /s/ 7/7/2020 ____________________________ ____________________ Barbara Stampul Date Acting Regional Manager, Southeast Region Office for Civil Rights RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 5 of 14 Appendix A CORRECTIVE ACTION PLAN BETWEEN THE UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES AND ATHENS ORTHOPEDIC CLINIC PA I. Preamble Athens Orthopedic Clinic PA (“AOC”) hereby enters into this Corrective Action Plan (“CAP”) with the United States Department of Health and Human Services, Office for Civil Rights (“HHS” or “OCR”). Contemporaneously with this CAP, AOC is entering into a Resolution Agreement (“Agreement”) with HHS, and this CAP is incorporated by reference into the Agreement as Appendix A. AOC enters into this CAP as consideration for the release set forth in Section II, Paragraph 3 of the Agreement. II. Contact Persons and Submissions A. Contact Persons AOC has identified the following individual as its authorized representative and contact person regarding the implementation of this CAP and for receipt and submission of notifications and reports: John D. “Randy” Dalbey, Attorney Chilivis, Grubman, Dalbey & Warner LLP 3127 Maple Drive, NE Atlanta, Georgia 30305 jddalbey@cglawfirm.com 404-262-6504 HHS has identified the following individual as its authorized representative and contact person with whom AOC is to report information regarding the implementation of this CAP: Barbara Stampul, Acting Regional Manager Office for Civil Rights, Southeast Region 61 Forsyth St, Suite 16T70 Atlanta, GA 30303-8909 Voice: (404) 562-7859 Fax: (404) 562-7881 Email: barbara.stampul@hhs.gov RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 6 of 14 AOC and HHS agree to promptly notify each other of any changes in the contact persons or the other information provided above. B. Proof of Submissions. Unless otherwise specified, all notifications and reports required by this CAP may be made by any means, including certified mail, overnight mail, or hand delivery, provided that there is proof that such notification was received. For purposes of this requirement, internal facsimile confirmation sheets do not constitute proof of receipt. III. Effective Date and Term of CAP The Effective Date for this CAP shall be calculated in accordance with Section II, Paragraph 9 of the Agreement (“Effective Date”). The period of compliance (“Compliance Term”) with the obligations assumed by AOC under this CAP shall begin on the Effective Date and end two (2) years from the Effective Date unless HHS has notified AOC under Section VIII hereof of its determination that AOC has breached this CAP. In the event of such a notification by HHS under Section VIII hereof, the Compliance Term shall not end until HHS notifies AOC that it has determined that the breach has been cured. After the Compliance Term ends, AOC shall still be obligated to submit the final Annual Report as required by Section VI and comply with the document retention requirement in Section VII. IV. Time Any reference to number of days refers to number of calendar days. In computing any period of time prescribed or allowed by this CAP, the day of the act, event, or default from which the designated period of time begins to run shall not be included. The last day of the period so computed shall be included, unless it is a Saturday, a Sunday, or a Federal holiday, in which event the period runs until the end of the next day which is not one of the aforementioned days. V. Corrective Action Obligations AOC agrees to the following: A. Business Associate Agreements 1. Within sixty (60) days of the Effective Date and annually following the Effective Date, AOC shall review all relationships with vendors and third party service providers to identify business associates. AOC shall provide HHS with the following: a. An accounting of AOC’s business associates, to include the names of business associates, a description of services provided, the date services began, and a description of the business associate’s handling of/interaction with AOC’s PHI; and b. Copies of the business associate agreements that AOC maintains with each business associate. RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 7 of 14 B. Risk Analysis and Risk Management 1. AOC shall conduct and complete an accurate, thorough, enterprise-wide analysis of security risks and vulnerabilities that incorporates all electronic equipment, data systems, programs and applications controlled, administered, owned, or shared by AOC or its affiliates that are owned, controlled or managed by AOC that contain, store, transmit or receive AOC ePHI. As part of this process, AOC shall develop a complete inventory of all electronic equipment, data systems, off-site data storage facilities, and applications that contain or store ePHI which will then be incorporated in its Risk Analysis. 2. Within 30 days of the Effective Date, AOC shall submit to HHS the scope and methodology by which it proposes to conduct the Risk Analysis. HHS shall notify AOC whether the proposed scope and methodology is or is not consistent with 45 C.F.R. § 164.308 (a)(l)(ii)(A). 3. AOC shall provide the Risk Analysis, consistent with paragraph V.B.l, to HHS within 120 days of HHS' approval of the scope and methodology described in paragraph V.B.2 for HHS' review. 4. Upon submission by AOC, HHS shall review and recommend changes to the aforementioned risk analysis. If HHS requires revisions to the Risk Analysis, HHS shall provide AOC with a detailed, written explanation of such required revisions and with comments and recommendations in order for AOC to be able to prepare a revised Risk Analysis. Upon receiving HHS’ recommended changes, AOC shall have thirty (30) calendar days to submit a revised risk analysis. This process will continue until HHS provides final approval of the risk analysis. 5. Within sixty (60) calendar days of HHS’s approval of the Risk Analysis, AOC shall develop an enterprise-wide risk management plan to address and mitigate any security risks and vulnerabilities identified in its risk analysis. The plan shall include a process and timeline for implementation, evaluation, and revision. The plan shall be forwarded to HHS for its review. 6. HHS shall review and recommend changes to the aforementioned risk management plan. Upon receiving HHS’ recommended changes, AOC shall have thirty (30) calendar days to submit a revised plan. This process will continue until HHS provides final approval of the plan. Upon HHS approval, AOC shall begin implementation of the plan and distribute to workforce members involved with the implementation of the plan. 7. AOC shall annually conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of e-PHI held by AOC, affiliates that are owned, controlled, or managed by AOC, and its engaged business associates, and document the security measures AOC implemented or is implementing to sufficiently reduce the identified risks and vulnerabilities to a reasonable and appropriate level. Subsequent risk analyses and corresponding management plans shall be submitted for review by HHS in the same manner as described in this section until the conclusion of the CAP. Revisions to policies and procedures in this section shall be made pursuant to Section V.D.5 below. RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 8 of 14 C. Policies & Procedures 1. AOC shall review and revise its written policies and procedures to comply with the Privacy, Security, and Breach Notification Rules, pursuant to 45 C.F.R. Part 160 and Subparts A, C and E of Part 164. AOC’s policies and procedures shall include, but not be limited to, the minimum content set forth in Paragraph V.E below. Additionally, in light of OCR’s investigation, particular revision is required to AOC’s policies and procedures relating to: - Technical access controls for any and all network/server equipment and systems to prevent impermissible access and disclosure of ePHI, - Technical access control and restriction for all software applications that contain ePHI to ensure authorized access is limited to the minimum amount necessary, - Technical mechanisms to create access and activity logs as well as administrative procedures to routinely review logs for suspicious events and respond appropriately, - Termination of user accounts when necessary and appropriate, - Appropriate configuration of user accounts to comply with the Minimum Necessary Rule, - Required and routine password changes, - Password strength and safeguarding, - Addressing and documenting security incidents, - Conducting routine, accurate, and thorough risk analyses and implementing corresponding security measures to sufficiently reduce identified risks and vulnerabilities to a reasonable and appropriate level, - Workforce training, - Documentation of workforce training, - Identification of business associates, - Engaging in compliant business associate agreements, - Breach notification content requirements. 2. AOC shall revise its Business Associate & Business Associate Agreement policies and procedures to: a. designate one or more individual(s) who are responsible for ensuring that AOC enters into a business associate agreement with each of its business associates, as defined by the HIPAA Rules, prior to AOC disclosing protected health information (PHI) to the business associate; b. create a process for assessing AOCs current and future business relationships to determine whether each relationship is with a “business associate," as that term is defined under the HIPAA Rules, and requires AOC to enter into a business associate agreement; c. create a process for negotiating and entering into business associate agreements with business associates prior to disclosing PHI to the business associates; d. create a standard template business associate agreement; e. create a process for maintaining documentation of a business associate agreement for at least six (6) years beyond the date of when the business associate relationship is terminated; and f. limit disclosures of PHI to business associates to the minimum necessary amount of RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 9 of 14 PHI that is reasonably necessary for business associates to perform their duties. 3. As necessary and appropriate, AOC shall create or revise policies and procedures in response to any findings in its risk analysis or to implement actions required by the corresponding risk management plan completed pursuant to Paragraph B above. 4. AOC shall provide such policies and procedures to HHS within ninety (90) days of receipt of HHS’ approval of the risk management plan required by Paragraph V.B above. Upon receiving any recommended changes to such policies and procedures from HHS, AOC shall have 30 days to revise such policies and procedures accordingly and provide the revised policies and procedures to HHS for review and approval. This process shall continue until HHS approves the policies and procedures. D. Adoption, Distribution, and Updating of Policies and Procedures 1. Within thirty (30) calendar days of obtaining HHS' approval of the policies and procedures required by Section V.C of this CAP, AOC shall finalize and officially adopt the policies and procedures in accordance with its applicable administrative procedures. 2. AOC shall distribute the approved policies and procedures to all AOC workforce members, including all workforce members of covered entities that are owned, controlled or managed by AOC, as appropriate. 3. AOC shall distribute the approved policies and procedures to all new workforce members within fourteen (14) days of when they become workforce members of AOC. The approved policies and procedures shall be provided to business associates and vendors at or before the time service commences. 4. At the time of distribution of policies and procedures, AOC shall document that workforce members have read, understand, and shall abide by such policies and procedures. AOC will not provide access to PHI unless and until this documentation is obtained. This documentation shall be retained in compliance with Section VII of this CAP. 5. AOC shall review the approved policies and procedures routinely and shall promptly update the policies and procedures to reflect changes in operations at AOC, federal law, HHS guidance, and/or any material compliance issues discovered by AOC that warrant a change in the policies and procedures. AOC shall assess, update, and revise, as necessary, the policies and procedures at least annually. AOC shall provide such revised policies and procedures to HHS for review and approval. Within thirty (30) days of any approved revisions, AOC shall distribute such revised policies and procedures to all workforce members. AOC shall document that workforce members have read, understand, and shall abide by such policies and procedures. AOC will not provide access to PHI unless and until this documentation is obtained. E. Minimum Content of the Policies and Procedures RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 10 of 14 The Policies and Procedures shall include measures to address the following Privacy and Security Provisions: Privacy Rule Provisions: 1. Uses and Disclosures of PHI - 45 CFR § 164.502(a) 2. Minimum Necessary - 45 CFR § 164.502(b) 3. Disclosures to Business Associates- 45 C.F.R. § 164.502(e)(1) 4. Training – 45 C.F.R. § 164.530(b)(1) 5. Safeguards - 45 C.F.R. § 164.530(c)(1) 6. Changes to Policies and Procedures - 45 C.F.R. § 164.530(i)(2) Security Rule Provisions: 7. Administrative Safeguards, including all required and addressable implementation specifications – 45 C.F.R. § 164.308(a) and (b). 8. Physical Safeguards, including all required and addressable implementation specifications – 45 C.F.R. § 164.310. 9. Technical Safeguards, including all required and addressable implementation specifications – 45 C.F.R. § 164.312. Breach Notification Rule Provisions: 10. Notification to Individuals, including all required and addressable implementation specifications – 45 C.F.R. § 164.404. 11. Notification to the Media, including all required and addressable implementation specifications – 45 C.F.R. § 164.406. 12. Notification to the Secretary of HHS, including all required and addressable implementation specifications – 45 C.F.R. § 164.408. F. Training 1. Within sixty (60) days of HHS’ approval of the revised policies and procedures required by this CAP, AOC shall submit its proposed training materials to HHS for its review and approval. 2. HHS will inform AOC in writing as to whether HHS approves or disapproves of the proposed training materials. If HHS disapproves of them, HHS shall provide AOC with comments and required revisions. Upon receiving notice of any required revisions to the training materials from HHS, AOC shall have thirty (30) calendar days in which to revise the training materials and then submit the revised training materials to HHS for review and approval. This process shall continue until HHS approves the training materials. 3. Within thirty (30) days of HHS’ approval of the training materials, AOC shall provide training to all workforce members, in accordance with AOC’s approved procedures. Any new workforce members that are hired during or after the initial training period RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 11 of 14 described in this paragraph shall be trained within fourteen (14) days of when they become workforce members of AOC and in all cases before being provided access to PHI. 4. AOC shall continue to provide routine retraining using the training materials HHS approved under this CAP to all workforce members for the duration of the Compliance Term of this CAP and as required by AOC approved training procedures. 5. Each workforce member who is required to receive training shall certify, in electronic or written form, that he or she received the training. The training certification shall specify the date on which the training was received. All training materials and certifications shall be retained in compliance with Section VII of this CAP. 6. AOC shall be responsible for ensuring workforce members comply with training requirements and complete all required training. 7. AOC shall review the training materials annually, and, where appropriate, update the training to reflect changes in Federal law or HHS guidance, any issues discovered during audits or reviews, and any other relevant developments. VI. Reportable Events and Annual Reports A. Reportable Events 1. During the Compliance Term, upon receiving information that a workforce member may have failed to comply with any provision of the revised policies and procedures required by this CAP, AOC shall promptly investigate the matter. If AOC determines that a workforce member has violated the revised policies and procedures required by this CAP, AOC shall notify HHS in writing within thirty (30) days. Such violations shall be known as “Reportable Events.” The report to HHS shall include the following: a. A complete description of the event, including relevant facts, the person(s) involved, and the implicated provision(s) of AOC’s Privacy, Security, and Breach Notification policies and procedures; and b. A description of actions taken and any further steps AOC plans to take to address the matter, to mitigate the harm, and to prevent it from recurring, including the application of appropriate sanctions against workforce members who failed to comply with Privacy, Security, and Breach Notification policies and procedures. 2. If no Reportable Events occur during any one Reporting Period, as defined in this CAP, AOC shall so inform HHS in its Annual Report for that Reporting Period. B. Annual Reports RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 12 of 14 1. The one-year period after HHS’ last approval of the policies and procedures required by Section V, Paragraph D of this CAP, and each subsequent one-year period during the Compliance Term, as defined in Section III of this CAP, shall each be known as a “Reporting Period.” AOC shall submit to HHS a report with respect to the status of and findings regarding its compliance with this CAP for each Reporting Period (“Annual Report”). AOC shall submit each Annual Report to HHS no later than thirty (30) days after the end of each corresponding Reporting Period. Each Annual Report shall include: a. An attestation signed by an officer of AOC attesting that the policies and procedures required by Section V of this CAP: (a) have been adopted; (b) are being implemented; and (c) have been distributed to all workforce members, business associates, and vendors; b. An updated accounting of business associates as required by Section V.A.; c. A copy of all training materials used for the workforce training required by Section V, Paragraph F of this CAP, a description of the training, including a summary of the topics covered, who conducted the training, who participated in the training, and a schedule of when the training session(s) were held; d. An attestation signed by an officer of AOC attesting that it is maintaining written or electronic certifications from all workforce members that are required to receive training that they received the requisite training pursuant to the requirements set forth on this CAP and pursuant to AOC’s approved training procedures; e. Evidence demonstrating that AOC has implemented security measures to reduce risks and vulnerabilities identified in its most recent risk analysis, which may include an updated risk management plan; f. An attestation signed by an officer of AOC listing all of its locations, the name under which each location is doing business, the corresponding mailing address, phone number and fax number for each location, and attesting that each location has complied with the obligations of this CAP; g. A summary of Reportable Events identified during the Reporting Period and the status of any corrective or preventative action(s) taken by AOC relating to each Reportable Event; and h. An attestation signed by an officer of AOC stating that he or she has reviewed the Annual Report, has made a reasonable inquiry regarding its content, and believes that, upon such inquiry, the information is accurate and truthful. VII. Document Retention AOC shall maintain for inspection and copying, and shall provide to HHS upon request, all RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 13 of 14 documents and records relating to compliance with this CAP for six (6) years from the Effective Date. VIII. Requests for Extensions and Breach Provisions AOC is expected to fully and timely comply with all provisions contained in this CAP. A. Timely Written Requests for Extensions AOC may, in advance of any due date set forth in this CAP, submit a timely written request for an extension of time to perform any act or file any notification or report required by this CAP. A “timely written request” is defined as a request in writing received by HHS at least five (5) days prior to the date by which any act is due to be performed or any notification or report is due to be filed. It is within HHS’s sole discretion as to whether to grant or deny the extension requested. B. Notice of Breach and Intent to Impose Civil Monetary Penalty (CMP) The Parties agree that a breach of this CAP by AOC constitutes a breach of the Resolution Agreement. Upon a determination by HHS that AOC has breached this CAP, HHS may notify AOC of (a) AOC’s breach; and (b) HHS’s intent to impose a civil money penalty (CMP) pursuant to 45 C.F.R. Part 160 for the Covered Conduct set forth in Section I, Paragraph 2 of the Agreement and any other conduct that constitutes a violation of the HIPAA Privacy, Security, or Breach Notification Rules (this notification is hereinafter referred to as the “Notice of Breach and Intent to Impose CMP”). C. Response. AOC shall have thirty (30) days from the date of receipt of the Notice of Breach and Intent to Impose CMPs from HHS to demonstrate to the satisfaction of HHS that: 1. AOC is in compliance with the obligations of this CAP that HHS cited as the basis for the breach; 2. The alleged breach has been cured; or 3. The alleged breach cannot be cured within the 30 day period, but that AOC (a) has begun to take action to cure the breach; (b) is pursuing such action with due diligence; and (c) has provided to HHS a reasonable timetable for curing the breach. D. Imposition of CMP. If at the conclusion of the 30 day period, AOC fails to respond under the requirements of Section VIII, Paragraph C to the satisfaction of HHS, HHS may proceed with the imposition of a CMP against AOC pursuant to 45 C.F.R. Part 160 for the Covered Conduct set forth in Section I, Paragraph 2 of the Agreement and any RA/CAP Athens Orthopedic Clinic PA - #16-245007 Page 14 of 14 other conduct that constitutes a violation of the HIPAA Rules. HHS shall notify AOC in writing of its determination to proceed with the imposition of a CMP. For Athens Orthopedic Clinic PA /s/ 7/6/2020 ___________________________ ____________________ Kayo Elliot Date Chief Executive Officer Athens Orthopedic Clinic PA For the United States Department of Health and Human Services /s/ 7/7/2020 ____________________________ ____________________ Barbara Stampul Date Acting Regional Manager, Southeast Region Office for Civil Rights