45 b) appropriate sanctions against the persons causing the breach which, depending upon the nature of the breach, may include oral or written reprimand, additional training, or termination of employment; c) mitigation of any harm caused by the breach, to the extent practica l ; and documentation of the incident and all actions taken to resolve the issue and mitigate any damages. 3) By executing the Welfare Benefit Plan Adoption A greement that accompanies this document , the Employer and all affiliated Employers agree to: a) Not use or further disclose the PHI other than as permitted or required by the Plan documents or as required by law; b) Implement reasonable and appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of Electronic Protected Health Information that the Employer creates, maintains or transmits on behalf of the Plan ; c) Ensure that any agent or subcontractor, (i) to whom it provides Protected Health Information received from the Plan , agrees to the same restrictions and conditions that apply to the Employer with respect to such information, and/or (ii) to whom it provides Electronic Protected Health Information shall agree, in writing, to implement reasonable and appropriate security measures to protect the Electronic Protected Health Information ; d) Not use or disclose PHI for employment - related actions and decisions or in connection with any other benefit or employee benefit plan of the Employer; e) Report to the Plan any use or disclosure of the PHI of which it becomes aware that is inconsistent with the uses or disclosures permitted by this Section, or required by law; f) Make available PHI to individual Plan members as required by Section 164.524 of the Privacy Standards; g) Make available PHI for amendment by individual Plan members and incorporate any amendments to Protected Health Information as required by Section 164.526 of the Privacy Standards; h) Make available the PHI required to provide an accounting of disclosures to individual Plan members as required by Section 164.528 of the Privacy Standards; i) Make its internal practices, books and records relating to the use and disclosure of PHI received from the Plan available to the Department of Health and Human Services for purposes of determining compliance by the Plan with the Privacy Standards; j) If feasible, return or destroy all PHI received from the Plan that the Employer still maintains in any form, and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible; and