(d) Subcontractor agrees to ensure that any agents, including a subcontractor, to whom it provides PIHI received from, or created or received by Subcontractor on behalf of NMHA agrees to the same restrictions and conditions that apply through this Exhibit to Subcontractor with respect to such information.

(e) Subcontractor agrees to make internal practices, books, and records relating to the use and disclosure of PIHI received from, or created or received by the Subcontractor on behalf of NMHA, to NMHA, for purposes of determining Subcontractor’s compliance with the Agreement including this Exhibit.

(f) Subcontractor agrees to make any amendments or corrections to PIHI maintained by Subcontractor within thirty (30) business days following a written request by the NMHA.

(g) Subcontractor agrees to comply with sections 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards), 164.316 (policies, procedures and documentation requirements) of the Security Rule, and the additional requirements of Title XIII of the Health Information Technology for Economic and Clinical Health Act contained in Public Law 111-5 (the “HITECH Act”) and any associated regulations that relate to security, with respect to the PIHI received from, or created or received by the Subcontractor on behalf of NMHA.

(h) Subcontractor agrees to ensure that any and all of Subcontractor’s subcontractors or agents to whom Subcontractor provides electronic PIHI agree to implement reasonable and appropriate safeguards to protect such electronic PIHI.

(i) Subcontractor agrees that it shall report promptly to NMHA any Security Incident of which Subcontractor becomes aware. The parties acknowledge and agree that this Section constitutes notice to Subcontractor by NMHA of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to NMHA shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Subcontractor’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PIHI.

(j) In the event of a Breach of any Unsecured PIHI that Subcontractor accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or uses on behalf of NMHA, Subcontractor shall provide notice of such Breach to NMHA immediately, but in no event more than three (3) days or the time after discovering the Breach, or such lesser time as may be required under applicable federal or state law.

Notice of a Breach shall include, at a minimum: (i) the identification of each individual whose PIHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the Breach, (ii) the date of the Breach, if known, (iii) the scope of the Breach, and (iv) a description of the Subcontractor’s response to the Breach.

In the event of a Breach, Subcontractor shall, in consultation with NMHA, mitigate, to the extent practicable, any harmful effect of such Breach that is known to Subcontractor.

(k) Subcontractor shall secure all electronic PIHI by a technology standard that renders the PIHI unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute and is consistent with guidance issued by the Secretary specifying the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, as added by Section 13101 of the HITECH Act.

(l) Subcontractor shall provide PIHI information in the electronic format to NMHA upon request.