United States. Congress

“ Breaches Treated as Discovered.— For purposes of this section, a breach shall be treated as discovered by a covered entity or by a business associate as of the first day on which such breach is known to such entity or associate, respectively, (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of such entity or associate, respectively) or should reasonably have been known to such entity or associate (or person) to have occurred. ”

“ The additional requirements of this subtitle that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. ”

“ Each such report shall include, with respect to such complaints received during the year— (A) the number of such complaints; (B) the number of such complaints resolved informally, a summary of the types of such complaints so resolved, and the number of covered entities that received technical assistance from the Secretary during such year in order to achieve compliance with such provisions and the types of such technical assistance provided ”

“ Later date.—The Secretary may set an effective date that is later that the date specified under subparagraph (A) or (B) if the Secretary determines that such later date is necessary, but in no case may the date specified under— " (i) subparagraph (A) be later than 2016; or " (ii) subparagraph (B) be later than 2013." ”