Comment on FR Doc # E9-26203

Can you please define what actions qualify as "corrected" as it is used in Table 1. For example if a laptop containing unencrypted protected health information is recovered three days after being misplaced in a public location, has the violation been corrected? If an individual whose protected health information has been improperly mailed to the wrong patient is informed of the breach and the information has been retrieved, has the violation been corrected? What actions are necessary for a covered entity or business associate to correct a violation?