Compliance & Privacy. All public sector cloud data must reside in the continental U.S. Numerous regulations pertain to the storage and use of data, including federal laws and regulations such as FISMA, the National Archives and Records Management Act (NARMA), North Carolina Records Retention and Disposition Schedule, Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the Xxxxxxxx-Xxxxx Act, among others. Many of these regulations require regular reporting and audit trails. Cloud providers must enable their customers to comply appropriately with these regulations. Please provide details of these controls. Provider must ensure that all critical data (credit card numbers, for example) are masked and that only authorized users have access to data in its entirety. Moreover, digital identities and credentials must be protected as should any data that the provider collects or produces about customer activity in the cloud. Please provide details of these controls. City data will not be used for vendor advertising or other promotional purposes. City data will not be sold to third parties. Please provide details of these controls. Provider has the ability to preserve, identify, collect, process, analyze and produce all forms of electronic files. All public sector cloud data must be discoverable in accordance with state and federal laws. Please provide details of these controls. Provider must comply with North Carolina statutes when dealing with legal issues, such as Contracts and E-Discovery, which may vary by state. Providers must also comply with the North Carolina Municipal Records Retention and Disposition Schedule. xxxx://xxxxxxxx.xxx/ich/cco/Documents/retention_09.pdf In addition to producing logs and audit trails, provider must work with the City to ensure that these logs and audit trails are properly secured, maintained for as long as the City requires, and are accessible for the purposes of forensic investigation (e.g., e-Discovery). Please provide details of these controls. Because so much of what’s behind the cloud is hidden, the City may need to conduct an audit or review past performance and certifications to gain a degree of trust as to what is going on within the infrastructure where our data will reside. It is critical that the provider allow for external audits. Many cloud providers do not allow customers to enter their data centers. In that case, it is important that they have provisions to allow ...
Compliance & Privacy. The Purchased IP is in compliance with all terms of service, terms of use, privacy policies and similar agreements or policies and applicable law governing the offering or provision of the products arising from the Purchased IP.
Compliance & Privacy. (a) Xxxxxxx’x performance and Company’s receipt of the Services and Alliance Benefits are subject to any requirements and restrictions under: (i) Applicable Laws, including (A) the U.S. federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b) and its implementing regulations, the federal Physician Self-Referral Law (42 U.S.C. § 1395nn) and its implementing regulations, the U.S. federal Foreign Corrupt Practices Act (15 U.S.C. §§ 77d1, 78m), and the U.S. federal False Claims Act (31 U.S.C. § 3729 et seq.), (B) those setting forth privacy, data security, breach notification, or data protection requirements for protected health information, personal information, personally identifiable information, personal data, or similar terms, and (C) protections for human subjects participating in Clinical Trials or other human subjects research, in addition to other cGCP guidelines and standards; (ii) IRB determinations, approvals, instructions, policies, or other requirements; (iii) the terms of any Informed Consent, HIPAA authorization, or other privacy consent, or IRB waiver or alteration of Informed Consent, HIPAA Authorization, or other privacy consent (as applicable), and (iv) applicable Moffitt policies and procedures. Without limiting the generality of the foregoing, if Company receives any individually identifiable health information (“IIHI”), as such term is defined in HIPAA, regarding any individual under an Underlying Agreement or this Agreement, the disclosure of which had not been authorized by such individual, Company shall hold the same in confidence in compliance with all Applicable Laws regarding the confidentiality of such records and Company will protect the confidentiality and security of the IIHI as if Company is a “covered entity,” as such term is defined in HIPAA.
