(A) Privacy. The certified IDR entity may create, collect, handle, disclose, transmit, access, maintain, store, and/or use IIHI, only to perform:
(1) The certified IDR entity's required duties described in this section; and
(2) Functions related to carrying out additional obligations as may be required under applicable Federal or State laws or regulations.
(B) Security. (1) The certified IDR entity must ensure the confidentiality of all IIHI it creates, obtains, maintains, stores, and transmits;
(2) The certified IDR entity must protect against any reasonably anticipated threats or hazards to the security of this information;
(3) The certified IDR entity must ensure that IIHI is securely destroyed or disposed of in an appropriate and reasonable manner 6 years from either the date of its creation or the first date on which the certified IDR entity had access to it, whichever is earlier;
(4) The certified IDR entity must implement policies and procedures to prevent, detect, contain, and correct security violations in the event of a breach of IIHI;
(C) Breach notification. The certified IDR entity must, following the discovery of a breach of unsecured IIHI, notify of the breach the provider, facility, or provider of air ambulance services; the plan; the Secretary, jointly with the Secretary of Health and Human Services and the Secretary of Labor; and each individual whose unsecured IIHI has been, or is reasonably believed to have been, subject to the breach, to the extent possible.
(1) Breaches treated as discovered. For purposes of this paragraph (e)(2)(v)(C), a breach shall be treated as discovered by a certified IDR entity as of the first day on which the breach is known to the certified IDR entity or, by exercising reasonable diligence, would have been known to the certified IDR entity. A certified IDR entity shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the certified IDR entity;
(2) Timing of notification. A certified IDR entity must provide the notification required by this paragraph (e)(2)(v)(C) without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
(3) Content of notification. The notification required by this paragraph (e)(2)(v)(C) must include, to the extent possible:
(i) The identification of each individual whose unsecured IIHI has been, or is reasonably believed by the certified IDR entity to have been, subject to the breach;
(ii) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, to the extent known;
(iii) A description of the types of unsecured IIHI that were involved in the breach (for example whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
(iv) A brief description of what the certified IDR entity involved is doing to investigate the breach, to mitigate harm to the affected parties, and to protect against any further breaches; and
(v) Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free telephone number, email address, website, or postal address.
(4) Method for providing notification. A certified IDR entity must submit the notification required by this paragraph (e)(2)(v)(C) in written form (in clear and understandable language) either on paper or electronically through the Federal IDR portal or electronic mail.