thanks Doug! just wondering if anyone else has an opinion? If the contract says we can provide lists, but don't, are we still obligated to disclose the possibility? Our auditor says we need to remove the language from the contract, or revise the privacy agreement. Other compliance consultants state no action is required, as in practice, we are not sharing NPPI- and that is the entire reason for the disclosure in the first place.
_________________________
Some days, it is all a mystery to me.