Banner Health Resolution Agreement and Corrective Action Plan

RESOLUTION AGREEMENT

I. Recitals

1. Parties. The Parties to this Resolution Agreement (“Agreement”) are:

A. The United States Department of Health and Human Services, Office for Civil Rights

(“HHS”), which enforces the Federal standards that govern the privacy of individually

identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the

“Privacy Rule”), the Federal standards that govern the security of electronic individually

identifiable health information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the

“Security Rule”), and the Federal standards for notification in the case of breach of

unsecured protected health information (45 C.F.R. Part 160 and Subparts A and D of 45

C.F.R. Part 164, the “Breach Notification Rule”). HHS has the authority to conduct

compliance reviews and investigations of complaints alleging violations of the Privacy,

Security, and Breach Notification Rules (the “HIPAA Rules”) by covered entities and

business associates, and covered entities and business associates must cooperate with HHS

compliance reviews and investigations. See 45 C.F.R. §§ 160.306(c), 160.308, and

160.310(b).

B. Banner Health, on behalf of the Banner Health Affiliated Covered Entities (Banner

Health ACE)

which meets the definition of “covered entity” under 45 C.F.R. § 160.103 and

therefore is required to comply with the HIPAA Rules.

C. HHS and Banner Health shall together be referred to herein as the “Parties.”

2. Factual Background and Covered Conduct

On August 17, 2018, HHS received a complaint against Banner Health from an attorney

(Complainant 1) on behalf of a client (Client 1). Complainant 1 alleged that Client 1

requested access to her medical records from Banner Estrella Medical Center, a Banner

Health ACE entity in December 2017, and did not receive the records until May 2018.

On January 3, 2020, HHS received a separate complaint against Banner Health from a law

firm employee (Complainant 2) who submitted the complaint on behalf of a client.

Complainant 2 alleged that her firm’s client (Client 2) requested access to an electronic

copy of his medical records from Banner Gateway Medical Center, a Banner Health ACE

entity, on July 15 and September 6, 2019. Banner Health ultimately sent Client 2’s records

to Complainant 2’s firm on February 5, 2020, and the firm received the records on February

11, 2020.

On February 5, 2019, and March 23, 2020, respectively, HHS notified Banner Health of its

investigation of Banner Health’s compliance with the HIPAA Rules promulgated by HHS

The health care entities set forth in Appendix A, attached hereto and incorporated by reference,

have been designated as Banner Health ACE pursuant to 45 C.F.R. § 164.105(b).

pursuant to the administrative simplification provisions of the Health Insurance Portability

and Accountability Act of 1996 (HIPAA), Pub.L. 104-191, 110 Stat. 1936. HHS’

investigations indicated that the following covered conduct occurred (“Covered Conduct”):

Banner Health failed to provide timely access to protected health information about Client

1 and Client 2 maintained by Banner Health in their respective designated record sets. (See

45 C.F.R. § 164.524(b)).

3. No Admission. This Agreement is not an admission of liability by Banner Health.

4. No Concession. This Agreement is not a concession by HHS that Banner Health is not in

violation of the HIPAA Rules and not liable for civil money penalties.

5. Intention of Parties to Effect Resolution. This Agreement is intended to resolve HHS

Transaction Numbers 19-321220 and 20-369420, and any violations of the HIPAA Rules

related to the Covered Conduct specified in paragraph I.2 of this Agreement. In

consideration of the Parties’ interest in avoiding the uncertainty, burden, and expense of

formal proceedings, the Parties agree to resolve this matter according to the Terms and

Conditions below.

II. Terms and Conditions

6. Payment. HHS has agreed to accept, and Banner Health has agreed to pay HHS, the

amount of $200,000.00 (“Resolution Amount”). Banner Health agrees to pay the

Resolution Amount on the Effective Date of this Agreement as defined in paragraph II.14

pursuant to written instructions to be provided by HHS.

7. Corrective Action Plan. Banner Health has entered into and agrees to comply with the

Corrective Action Plan (“CAP”), attached as Appendix B, which is incorporated into this

Agreement by reference. If Banner Health breaches the CAP, and fails to cure the breach

as set forth in the CAP, then Banner Health will be in breach of this Agreement and HHS

will not be subject to the Release set forth in paragraph II.8 of this Agreement.

8. Release by HHS. In consideration of and conditioned upon Banner Health’s performance

of its obligations under this Agreement, HHS releases Banner Health from any actions it

may have against Banner Health under the HIPAA Rules arising out of or related to the

Covered Conduct identified in paragraph I.2 of this Agreement. HHS does not release

Banner Health from, nor waive any rights, obligations, or causes of action other than those

arising out of or related to the Covered Conduct referred to in this paragraph. This release

does not extend to actions that may be brought under Section 1177 of the Social Security

Act, 42 U.S.C. § 1320d-6.

9. Agreement by Released Parties. Banner Health shall not contest the validity of its

obligation to pay, nor the amount of, the Resolution Amount or any other obligations

agreed to under this Agreement. Banner Health waives all procedural rights granted under

Section 1128A of the Social Security Act (42 U.S.C. § 1320a- 7a) and 45 C.F.R. Part 160

Subpart E, and HHS claims collection regulations at 45 C.F.R. Part 30, including, but not

limited to, notice, hearing, and appeal with respect to the Resolution Amount.

10. Binding on Successors. This Agreement is binding on Banner Health and its successors,

heirs, transferees, and assigns.

11. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in

connection with this matter, including the preparation and performance of this Agreement.

12. No Additional Releases. This Agreement is intended to be for the benefit of the Parties

only and by this instrument the Parties do not release any claims against or by any other

person or entity.

13. Effect of Agreement. This Agreement constitutes the complete agreement between the

Parties. All material representations, understandings, and promises of the Parties are

contained in this Agreement. Any modifications to this Agreement shall be set forth in

writing and signed by all Parties.

14. Execution of Agreement and Effective Date. The Agreement shall become effective (i.e.,

final and binding) upon the date of signing of this Agreement and the CAP by the last

signatory (Effective Date).

15. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a-7a(c)(1), a civil money

penalty (“CMP”) must be imposed within six years from the date of the occurrence of the

violation. To ensure that this six-year period does not expire during the term of this

Agreement, Banner Health agrees that the time between the Effective Date of this

Agreement and the date the Agreement may be terminated by reason of Banner Health’s

breach, plus one-year thereafter, will not be included in calculating the six (6) year statute

of limitations applicable to the violations which are the subject of this Agreement. Banner

Health waives and will not plead any statute of limitations, laches, or similar defenses to

any administrative action relating to the Covered Conduct identified in paragraph I.2 that

is filed by HHS within the time period set forth above, except to the extent that such

defenses would have been available had an administrative action been filed on the Effective

Date of this Agreement.

16. Disclosure. HHS places no restriction on the publication of the Agreement.

17. Execution in Counterparts. This Agreement may be executed in counterparts, each of

which constitutes an original, and all of which shall constitute one and the same agreement.

18. Authorizations. The individual(s) signing this Agreement on behalf of Banner Health

represents and warrants that they are authorized to execute this Agreement and bind Banner

Health, as set forth in paragraph I.1.B. The individual(s) signing this Agreement on behalf

of HHS represent and warrant that they are signing this Agreement in their official

capacities and that they are authorized to execute this Agreement.

For Banner Health

/s/ 01/04/2021

____________________________ ____________

Peter S. Fine, CEO Date

Banner Health

2901 North Central Avenue, Suite 160

Phoenix, Arizona 85012

For Department of Health and Human Services

/s/ 01/06/2021

____________________________ _____________

Andrea Oliver Date

Regional Manager, Rocky Mountain Region

Office for Civil Rights

Appendix A

A. BANNER HEALTH

The single affiliated covered entity includes, without limitation, the following operations and

components owned or operated directly by Banner Health.

Acute Care Hospitals

• Banner Ocotillo Medical Center, Chandler, AZ

• Wyoming Medical Center, Casper, WY

• Banner Baywood Medical Center, Mesa, AZ

• Banner Behavioral Health Hospital, Scottsdale, AZ

• Banner Boswell Medical Center, Sun City, AZ

• Banner Casa Grande Medical Center, Casa Grande, AZ

• Banner Churchill Community Hospital, Fallon, NV

• Banner Del E Webb Medical Center, Sun City West, AZ

• Banner Desert Medical Center, Mesa, AZ

• Banner Estrella Medical Center, Phoenix, AZ

• Banner Fort Collins Medical Center, Fort Collins, CO

• Banner Gateway Medical Center, Gilbert, AZ

• Banner Goldfield Medical Center, Apache Junction, AZ

• Banner Heart Hospital, Mesa, AZ

• Banner Ironwood Medical Center, San Tan Valley, AZ

• Banner Lassen Medical Center, Susanville, CA

• Banner MD Anderson Cancer Center, Gilbert, AZ

• Banner Payson Medical Center, Payson, AZ

• Banner Thunderbird Medical Center, Glendale, AZ

• Banner--University Medical Center Phoenix, Phoenix, AZ

• Banner--University Medical Center South, Tucson, AZ

• Banner--University Medical Center Tucson, Tucson, AZ

• Cardon Children’s Medical Center, Mesa, AZ

• Community Hospital, Torrington, WY

• East Morgan County Hospital, Brush, CO

• McKee Medical Center, Loveland, CO

• North Colorado Medical Center, Greeley, CO

• Ogallala Community Hospital, Ogallala, NE

• Page Hospital, Page, AZ

• Platte County Memorial Hospital, Wheatland, WY

• Sterling Regional MedCenter, Sterling, CO

• Washakie Medical Center, Worland, WY

B. AFFILIATED COVERED ENTITIES OF BANNER HEALTH

1. Arizona Alzheimer’s Research Center, Inc.

2. Banner Ambulatory Provider Group, LLC

3. Banner Ambulatory Provider Group Colorado, LLC

4. Banner Anesthesiologists—Colorado, LLC

5. Banner Anesthesiologists West, LLC

6. Banner Cancer Center Specialists, LLC

7. Banner Children’s—Banner Health Clinic, LLC

8. Banner Employer Services, LLC

9. Banner Estrella Surgery Center, LLC, Phoenix, AZ

10. Banner Health Network

11. Banner Health Physicians—Colorado, LLC

12. Banner Health Physicians—West, LLC

13. Banner Hospital-Based Physicians—Arizona, LLC

14. Banner Hospital-Based Physicians—Colorado, LLC

15. Banner Hospital-Based Physicians—West, LLC

16. Banner Indemnity, Ltd.

17. Banner Imaging Services, LLC

18. Banner Medical Group (various locations in AZ, CA, NE, NV, WY)

19. Banner Medical Group Colorado (various locations in CO)

20. Banner Medical Group Dental Services, LLC

21. Banner Mesa Surgery Center, LLC

22. Banner Network Colorado, LLC

23. Banner Northern Colorado Imaging, LLC

24. Banner Occupational Health—Arizona, LLC

25. Banner Occupational Health Colorado, LLC

26. Banner Occupational Health—Colorado, LLC

27. Banner Occupational Health—Onsite, L.L.C.

28. Banner Peoria Surgery Center, LLC

29. Banner Pharmacy Services, LLC

30. Banner Phoenix Surgery Center, LLC

31. Banner Physician Specialists—Arizona, LLC

32. Banner Physician Super-Specialists—Arizona, LLC

33. Banner Plan Administration, Inc.

34. Banner Primary Care Physicians—Arizona, LLC

35. Banner Quick Care, LLC

36. Banner Quick Care Colorado, LLC

37. Banner Sun City West Surgery Center, LLC

38. Banner Surgery Center—Alvernon, LLC

39. Banner Surgery Centers, LLC

40. Banner Union Hills Surgery Center, LLC

41. Banner—University Dental Services, LLC

42. Banner—University Hospital Based Physicians, LLC

43. Banner—University Medical Center South Campus, LLC, Tucson AZ

44. Banner—University Medical Center Tucson Campus, LLC, Tucson, AZ

45. Banner—University Medical Group (various locations in Phoenix and Tucson, AZ)

46. Banner—University Medicine Crisis Response Center, LLC

47. Banner—University Physician Specialists, LLC

48. Banner—University Primary Care Physicians, LLC

49. Banner—University Super Specialists, LLC

50. Banner Urgent Care—Arizona, LLC

51. Banner Urgent Care—Colorado, LLC

52. Banner Urgent Care Services, LLC

53. BHSM Rehabilitation, LLC

54. B—UMCP Hospital Based Physicians LLC

55. B—UMCP Physician Specialists LLC

56. B—UMCP Primary Care Physicians LLC

57. B—UMCP Super Specialists LLC

58. B—UMG Integrated Health Clinic, LLC

59. B—UMG Tucson AP Physicians LLC

60. Horizon Laboratory, LLC (CO)

61. Laboratory Sciences of Arizona, L.L.C.

62. Loveland Medical Enterprises, LLC

63. Loveland Surgical Enterprises, LLC (CO)

64. McKee Medical Holdings, L.L.C.

65. MMC Outpatient Services, LLC (CO)

66. Mountain Vista Orthopaedic Surgery Center, LLC, Greeley, CO

67. NCMC + BH Greeley I, LLC

68. NCMC + BH Greeley II, LLC

69. Neighborhood Physician Alliance, LLC

70. Sonora Quest Laboratories LLC

71. Supply Chain Value Network, LLC

72. The University of Arizona Health Plans - University Care Advantage, Inc.

73. The University of Arizona Health Plans - Family Care, Inc.

74. The University of Arizona Health Plans - University Healthcare, Inc.

75. Any other entity that is or becomes designated as a member of Banner Health ACE.

Appendix B

CORRECTIVE ACTION PLAN

BETWEEN THE

DEPARTMENT OF HEALTH AND HUMAN SERVICES

AND

BANNER HEALTH

I. Preamble

Banner Health hereby enters into this Corrective Action Plan (“CAP”) with the United

States Department of Health and Human Services, Office for Civil Rights (“HHS”).

Contemporaneously with this CAP, Banner Health is entering into the Agreement with HHS, and

this CAP is incorporated by reference into the Agreement as Appendix B. Banner Health enters

into this CAP as part of consideration for the release set forth in paragraph II.8 of the Agreement.

Capitalized terms without definition in this CAP shall have the same meaning assigned to them

under the Agreement.

II. Contact Persons and Submissions

A. Contact Persons

The contact person for Banner Health regarding the implementation of this CAP and for

receipt and submission of notifications and reports (“Banner Health Contact”) is:

Ms. Kristen Eversole, BS, RHIA, CHPC

Privacy Sr. Director/Chief Privacy Officer

Banner Health

2901 North Central Avenue, Suite 160

Phoenix, Arizona 85012

HHS has identified the following individual as its authorized representative and contact

person with whom Banner Health is to report information regarding the implementation of this

CAP:

Ms. Andrea Oliver, Regional Manager

Office for Civil Rights, Rocky Mountain Region

Department of Health and Human Services

1961 Stout Street, Room 08.148

Denver, Colorado 80294

Andrea.Oliver @hhs.gov

Telephone: 303-844-7915

Facsimile: 303-844-2025

Banner Health and HHS agree to promptly notify each other of any changes in the contact person

the other information provided above.

B. Proof of Submissions. Unless otherwise specified, all notifications and reports

required

by this CAP may be made by any means, including certified mail,

overnight mail,

electronic mail, or hand delivery, provided that there is proof that such notification

was

received. For purposes of this requirement, internal facsimile confirmation

sheets do not

constitute proof of receipt.

III. Effective Date and Term of CAP

The Effective Date for this CAP shall be calculated in accordance with paragraph II.14 of

the Agreement (“Effective Date”). The period for compliance (“Compliance Term”) with the

obligations assumed by Banner Health under this CAP shall begin on the Effective Date of this

CAP

and end two (2) years from the Effective Date, unless HHS has notified Banner Health under

Section VIII hereof of its determination that Banner Health breached this CAP. In the event of

such a notification by HHS under Section VIII hereof, the Compliance Term shall not end until

HHS notifies Banner Health that it has determined that the breach has been cured. After the

Compliance Term

ends, Banner Health shall still be obligated to: (a) submit the final Annual Report

as required by

Section VI.B; and (b) comply with the document retention requirement in Section

VII. Nothing in

this CAP is intended to eliminate or modify Banner Health’s obligation to comply

with the document

retention requirements in 45 C.F.R. §§ 164.316(b) and 164.530(j).

IV. Time

In computing any period of time prescribed or allowed by this CAP, all days referred to

shall be calendar days. The day of the act, event, or default from which the designated period of

time begins to run shall not be included. The last day of the period so computed shall be

included,

unless it is a Saturday, a Sunday, or a legal holiday, in which event the period runs

until the end of

the next day which is not one of the aforementioned days.

V. Corrective Action Obligations

Banner Health agrees to the following:

A. Policies and Procedures

1. Banner Health shall review and, to the extent necessary, revise its written policies,

procedures, and other written communications related to the provision of access to medical

records, specifically including, but not limited to, Banner Health’s “Patient Request for Records”

policy.

2. Banner Health shall provide such policies and procedures, consistent with

paragraph 1 above, to HHS within sixty (60) days of the Effective Date for review and approval.

Upon receiving any recommended changes to such policies and procedures from HHS, Banner

Health shall have thirty (30) days to revise such policies and procedures accordingly and provide

the revised policies and procedures to HHS for review and approval. This process shall continue

until HHS approves the policies and procedures.

3. Banner Health shall implement such policies and procedures within thirty (30) days

of receipt of HHS’ approval.

B. Distribution and Updating of Policies and Procedures

1. Banner Health shall distribute the policies and procedures identified in Section V.A

to all members of the workforce within thirty (30) days of HHS approval of such policies and to

new members of the workforce within thirty (30) days of their beginning of service.

2. Banner Health shall require, at the time of distribution of such policies and

procedures, a signed written or electronic initial compliance certification from all members of the

workforce stating that the workforce members have read, understand, and shall abide by such

policies and procedures.

3. Banner Health shall assess, update, and revise, as necessary, the policies and

procedures at least annually or as needed. Banner Health shall provide such revised policies and

procedures to HHS for review and approval. Within thirty (30) days of the effective date of any

approved substantive revisions, Banner Health shall distribute such revised policies and

procedures to all members of its workforce and shall require new compliance certifications.

C. Minimum Content of Policies and Procedures

The Policies and Procedures referred to in Section V.A.1 shall include, but not be limited

to:

1. Review and update as necessary Banner Health’s “Patient Request for Records”

policy to ensure comprehensive and accurate responses to requests for records.

2. Protocols for training all Banner Health’s workforce members that are involved in

receiving or fulfilling access requests as necessary and appropriate to ensure compliance with the

policies and procedures provided for in Section V.A.1 above.

3. Application of appropriate sanctions against Banner Health workforce members

who fail to comply with policies and procedures provided for in Section V.A.1 above.

D. Training

1. Banner Health shall provide HHS with training materials per Section V.C.2 above

for applicable members of the workforce within sixty (60) days of the approval of its policies and

procedures per Section V.A.

2. Upon receiving notice from HHS specifying any required changes, Banner Health

shall make the required changes and provide revised training materials to HHS within thirty (30)

days.

3. Upon receiving approval from HHS, Banner Health shall provide training for each

workforce member within sixty (60) days of HHS approval and at least every twelve (12) months

thereafter. Banner Health shall also provide such training to each new member of the workforce

within thirty (30) days of their beginning of service.

4. Each workforce member who is required to attend training shall certify, in

electronic or written form, that he or she has received the training. The training certification shall

specify the date training was received. All course materials shall be retained in compliance with

Section VII.

5. Banner Health shall review the training at least annually, and, where appropriate,

update the training to reflect changes in Federal law or HHS guidance, any issues discovered

during audits or reviews, and any other relevant developments.

E. Reportable Events

During the Compliance Term, Banner Health shall, upon receiving information that a

workforce member may have failed to comply with its access policies and procedures, promptly

investigate this matter. If Banner Health determines, after review and investigation, that a member

of its workforce has failed to comply with these policies and procedures, Banner Health shall notify

HHS in writing within thirty (30) days. Such violations shall be known as Reportable Events. The

report to shall include the following information:

1. A complete description of the event, including the relevant facts, the persons

involved, and the provision(s) of the policies and procedures implicated; and

2. A description of the actions taken and any further steps Banner Health plans to take

to address the matter to mitigate any harm, and to prevent it from recurring, including application

of appropriate sanctions against workforce members who failed to comply with its Privacy Rule

policies and procedures.

VI. Implementation Report and Annual Reports

A. Implementation Report.

Within 120 days after the receipt of HHS’ approval of the policies and procedures

required by Section V.A.1, Banner Health shall submit a written report to HHS summarizing the

status of its implementation of the requirements of this CAP. This report, known as the

“Implementation Report,” shall include:

1. An attestation signed by an owner or officer of Banner Health attesting that the

policies and procedures are being implemented, have been distributed to all appropriate members

of the workforce and that Banner Health has obtained all of the compliance certifications required

by Sections V.B.2. and V.B.3.;

2. A copy of all training materials used for the training required by this CAP (if

not previously provided, or materially different than the training materials that OCR approved in

accordance with Section V.D.), a description of the training, including a summary of the topics

covered, the length of the session(s) and a schedule of when the training session(s) were held;

3. An attestation signed by an owner or officer of Banner Health attesting that all

workforce members have completed the initial training required by this CAP and have executed

the training certifications required by Section V.D.4.;

4. An attestation signed by an owner or officer of Banner Health stating that he or

she has reviewed the Implementation Report, has made a reasonable inquiry regarding its content

and believes that, upon such inquiry, the information is accurate and truthful.

B. Annual Reports.

The one (1) year period after the Effective Date and each

subsequent one (1) year

period during the course of the Compliance Term shall be

known as a “Reporting Period.”

Within sixty (60) days after the close of each corresponding Reporting Period, Banner Health

shall submit a report or reports to

HHS regarding Banner Health’s compliance with this

CAP for

each corresponding Reporting Period (“Annual Report”). The Annual Report shall include:

1. A copy of the schedule, topic outline, and training materials (if not previously

provided, or materially different than the training materials that OCR approved in accordance with

Section V.D.) for the training programs provided during the Reporting Period that is the subject of

the Annual Report;

2. An attestation signed by an officer or director of Banner Health attesting that

it is obtaining and maintaining written or

electronic training certifications from all persons who

are required to attend training under this CAP;

3. An attestation signed by an officer or director of Banner Health attesting that

any revision(s) to the policies and procedures required by Section V.A were finalized and

adopted within thirty (30) days of HHS’ approval of the revision(s), which shall

include a

statement affirming that Banner Health distributed the

revised Policies and Procedures to all

appropriate members of Banner Health’s workforce within sixty (60) days of HHS’ approval

of the revision(s); and

4. A summary of Reportable Events (defined in Section V.E), if any, the status of

any corrective and preventative action(s) relating to all such Reportable Events, or an attestation

signed by an officer or director of Banner Health stating that no Reportable Events occurred during

the Compliance Term.

5. An attestation signed by an owner or officer of Banner Health attesting that he

or she has reviewed the Annual Report, has made a reasonable inquiry regarding its content and

believes that, upon such inquiry, the information is accurate and truthful.

VII. Document Retention

Banner Health shall maintain for inspection and copying, and shall provide to

HHS,

upon request, all documents and records relating to compliance with this CAP for six (6)

years

from the Effective Date.

VIII. Breach Provisions

Banner Health i s expected to fully and timely comply with all provisions contained in

this CAP.

A. Timely Written Requests for Extensions.

Banner Health may, in

advance of any due date set forth in this CAP, submit a timely

written request for

an extension of time to perform any act required by this CAP. A “timely

written request” is defined as a request in writing received by HHS at least five (5) days

prior to the date such an act is required or due to be performed. This requirement may be

waived by HHS only.

B. Notice of Breach of this CAP and Intent to Impose CMP.

The Parties agree that a breach of this CAP by Banner Health constitutes a

breach of

the Agreement. Upon a determination by HHS that Banner Health has breached this CAP, HHS

may notify Banner Health of: (1) Banner Health’s breach; and (2) HHS’ intent to impose a CMP

pursuant to 45 C.F.R. Part 160, for the Covered Conduct set forth in paragraph I.2 of the

Agreement and any other conduct that constitutes a violation of the HIPAA Privacy, Security

or Breach Notification

Rules (“Notice of Breach and Intent to Impose CMP”).

C. Banner Health’ s Response.

If Banner Health is named in a Notice of Breach and Intent to Impose CMP, Banner

Health shall have thirty (30) days from the date of receipt of the Notice of Breach and Intent

to Impose CMP to demonstrate to HHS’ satisfaction that:

1. Banner Health is in compliance with the obligations of the

CAP that HHS cited

as the basis for the breach;

The

alleged breach has been cured; or

3. The alleged breach cannot be cured within the thirty (30) day period, but that

Banner Health: (a) has begun to take action to cure the

breach; (b) is pursuing such action with

due

diligence; and (c) has provided to HHS a

reasonable timetable for curing the breach.

D. Imposition of CMP.

If at the conclusion of the thirty (30) day period, Banner Health fails to meet the

requirements of Section VIII.C of this CAP to

HHS’ satisfaction, HHS may proceed with the

imposition of a CMP against Banner Health pursuant to the rights and obligations set forth in 45

C.F.R. Part 160 for any violations of the HIPAA Rules applicable to the Covered Conduct set

forth in paragraph I.2 of the Agreement and for any

other act or failure to act that constitutes a

violation of the HIPAA Rules. HHS

shall notify Banner Health Contact in writing of its

determination to proceed with the imposition of a CMP pursuant to 45 C.F.R. §§ 160.312(a)(3)(i)

and (ii).

For Banner Health

/s/ 01/04/2021

___________________________ ________________________

Peter S. Fine, CEO Date

Banner Health

For Department of Health and Human Services

/s/ 01/06/2021

___________________________ ________________________

Andrea Oliver Date

Regional Manager, Rocky Mountain Region

Office for Civil Rights