Contractor’s Compliance with Privacy and Security Provisions of State Contract Clause Samples
This clause requires the contractor to adhere to all privacy and security requirements specified in the state contract. In practice, this means the contractor must implement appropriate safeguards to protect sensitive data, follow prescribed protocols for handling personal information, and promptly report any security incidents or breaches. The core function of this clause is to ensure that the contractor maintains the confidentiality and integrity of data, thereby reducing the risk of unauthorized disclosure and ensuring compliance with state regulations.
Contractor’s Compliance with Privacy and Security Provisions of State Contract. 8.1 The County receives funding from DHCS pursuant to an annual contracting arrangement (hereinafter “State Contract”). The State Contract contains certain requirements pertaining to the privacy and security of PI and/or PHI and requires that County contractually obligate any of its sub-contractors to also comply with these requirements. Contractor hereby agrees to be bound by, and comply with, any and all terms and conditions of the State Contract pertaining to the privacy and/or security of PI and/or PHI. This include ensuring that all workstations, laptops and removable media devices that process and/or store DHCS PHI or PI must be encrypted using a FIPS 140-2 certified algorithm which is 256bit or higher. A hard copy of the State-County Contract will be provided to the Contractor upon request, and an electronic copy can be found on the BHRS website at ▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/▇▇▇▇.
8.2 Additionally, in the event the State Contract requires the County to notify the State of a breach of privacy and/or security of personally identifiable information (hereinafter PII) and/or PHI, Contractor shall, immediately upon discovery of a suspected or actual breach of privacy and/or security of PII and/or PHI by Contractor, notify the County of Marin, Health and Human Services Compliance Program of such breach by telephone and email or facsimile (contact details below). Contractor further agrees that it shall notify County of any such breaches prior to the time the County is required to notify the State pursuant to the State Contract. Email: ▇▇▇▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇▇.▇▇▇
8.3 In the event the State Contract requires the County to pay any costs associated with a breach of privacy and/or security of PII and/or PHI, including but not limited to the costs of notification, Contractor shall pay on County’s behalf any and all such costs arising out of a breach of privacy and/or security of PII and/or PHI by Contractor.
8.4 Contractor shall maintain personnel controls to protect PHI or PI, including, but not limited to ensuring all workforce members accessing or disclosing PHI or PI: complete information privacy and security training at least annually; sign a confidentiality statement prior to accessing PHI or PI and annually thereafter; and performing a background check and evaluating the results to assure that there is no indication of a risk to the security or integrity of confidential data. Records shall be retained pursuant to the SABG Contract and DMC-ODS IA.
8.5 All work perf...