HIPAA GENERAL OPERATING POLICY #34
MITIGATION
A HCC must mitigate, to the extent practicable, any harmful effect that is known to the HCC of a use or disclosure of PHI in violation of its policies and procedures or the requirements of the Privacy Rule by the HCC or any business associate.