Common use of CRIMINAL/CIVIL SANCTIONS Clause in Contracts

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor Consultant to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974of1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Exhibit 4 of Publication 1075 Exhibit 41075, Sanctions for Unauthorized Disclosure, and Exhibit 55 of Publication 1075, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Section 10 of Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor Consultant must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need- to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. (4) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency [DSHS] records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having (5) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor officer or employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s [DSHS’s] security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s A contractor and each officer or employee must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertificationrecertification of their understanding of the agency’s [DSHS’s] security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will a contractor and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see [IRS Publication 1075 1075] Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s [DSHS’s] security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certificationrecertifications, the Contractor contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee Contractor Staff of any person a Contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee Contractor Staff can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee Contractor Staff of any person a Contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return or return information made available in any format shall Contractor Staff may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each Contractor Staff of a Contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee Contractor Staff in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. (4) Additionally, it is incumbent upon the Contractor to inform its officers and employees Contractor Staff of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her their employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having (5) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with Staff understands ITS’s security policies and procedures for safeguarding FTI. The Contractor and Contractor Staff must maintain their authorization to access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateFTI through annual recertification of their understanding of ITS’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertificationFTI. The initial certification and recertification recertifications must be documented and placed in the State's ITS’s files for review. As part of the certification, certification and at least annually afterwards, the Contractor will and each Contractor Staff must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on ITS’s security policies and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certificationrecertifications, the Contractor and each Contractor Staff must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of or any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecutionwriting. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of or any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 one (1) year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee (United States for federal employees) in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunderunder it, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractParticipating Addendum. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Participating Addendum. Inspection by or disclosure to anyone without an official need to need- to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Granting Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractor must maintain its authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). 10 ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. a. Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. b. Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . c. Each officer or employee of a contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. d. Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having e. Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor officer or employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s A contractor and each officer or employee must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertificationrecertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will a contractor and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certificationrecertifications, the Contractor contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee Contractor Staff (hereinafter in this Section, Contractor "person") of any person Contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information the FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information FTI is or may be disclosed shall be notified in writing by such person that any return or return information FTI made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the this Contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1552a (i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s ITS' security policy policies and procedures for safeguarding Federal tax informationIRS Data. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's ITS' files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A 7213A. (see See, IRS Publication 1075 1075: Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See See, IRS Publication 1075, : Section 10, Reporting Improper Inspections or Disclosures). For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized DisclosureDisclosure of IRS Publication 1075). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Section 10 of IRS Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 5. (4) U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to (5) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.Section

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at in 26 CFR C.F.R. § 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at in 26 CFR C.F.R. § 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a§ 552(a). Specifically, 5 U.S.C. 552a(i)(1§ 552(a)(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1§ 552(a)(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s agency's security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A 7213A. (see IRS Publication 1075 See Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized DisclosureDisclosure of the IRS Publication 1075). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.10.0,

CRIMINAL/CIVIL SANCTIONS. 1. 3.4.2.1 Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 5,000.00 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 1,000.00 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections Sections 7213 and 7431 and 7431and set forth at 26 CFR 301.6103(n)-1. 2. 3.4.2.2 Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 one (1) year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section Sections 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. 3.4.2.3 Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having 3.4.2.4 Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's agency’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the DEPARTMENT OF TECHNOLOGY AGREEMENT NO. 20-14312, SC NO. 00-0000000 performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign contractor should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.requirements.1

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractParticipating Addendum. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Participating Addendum. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Granting Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractor must maintain its authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). 10 ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign contractor should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.requirements.1

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.as (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns ofreturns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section !RC 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974197 4, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractParticipating Addendum. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Participating Addendum. Inspection by or disclosure to anyone without an official need to need- to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Granting Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractor must maintain its authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). 10 ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information inf ormation disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine f ine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information inf ormation made available in any format shall be used only for the purpose of carrying out the provisions of this Grant Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Grant Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine f ine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor Grantee to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Grantees by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorGrantee, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a Grantee access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateTennCare’s security policy and procedures for safeguarding Federal tax saf eguarding IRS information. Contractor’s Grantees must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification recertif ication must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Grantees should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). 7213A. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor must sign Grantee should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at in 26 CFR C.F.R. § 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at in 26 CFR C.F.R. § 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a§ 552(a). Specifically, 5 U.S.C. 552a(i)(1§ 552(a)(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1§ 552(a)(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s agency's security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.,

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person the Contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person the Contractor that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person the Contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by the Contractor that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need- to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each officer or employee of the Contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing by the Contractor that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. (4) Additionally, it is incumbent upon the Contractor to shall inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. (5) Prior to Contractor having access to Federal tax informationFTI, Contractor shall certify that each Contractor officer or employee who will use or other individual with access to or who use Federal tax information FTI on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s authorization to access Federal tax information FTI hereunder shall be contingent upon annual recertificationrecertification that each such officer or employee understands the State’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the State's ’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the State’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See see IRS Publication 10751075 Section 1.8, Section 10Reporting Improper Inspections or Disclosures). For both the initial certification and the annual certificationrecertifications, the Contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.Section

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 26 U.S.C. §§ 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractthe Underlying Agreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractUnderlying Agreement. Inspection by or disclosure to anyone without an official need need-to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 26 U.S.C. §§ 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency [MHBE] records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateMHBE’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the StateMHBE's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 26 U.S.C. §§ 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and IRS Publication 1075 Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See IRS Publication 1075, 1075 Section 10). For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign contractor should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such Each officer and employee shall be further notified that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections §§7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to know any unauthorized person constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each Each such officer and employee shall be notified that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section §§ 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateIDR’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's IDR’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will the contractor shall be advised of the provisions of IRCs 7431, IRC §§7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure7213A, and Exhibit 5, Civil Damages for Unauthorized Disclosure)7431. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, 1075 Section 10). For both the initial certification and the annual certification, the Contractor must sign contractor’s employees, agents, and subcontractors shall sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements. The following Special Terms and Conditions/Ancillary Agreement are part of and incorporated into the State of Iowa Technology Products, Services, and Solutions Master Agreement, Contract No. 2018 BUS 0105, (“Agreement”) between the State of Iowa, acting by and through the Office of the Chief Information Officer (“OCIO”), and Insight Public Sector, Inc., a corporation organized under the laws of Illinois (“Vendor”). Capitalized terms used but not defined herein are as defined in the Agreement. These Special Terms and Conditions/Ancillary Agreement apply to any Services provided to the Governmental Entities identified in attachment A hereto. State of Iowa Business Associate Agreement‌ THIS Business Associate Agreement (“BAA”) supplements and is made a part of the Agreement (hereinafter, the “Underlying Agreement”) between the Governmental Entities identified in attachment A (the “Agency”) and the Contractor (the “Business Associate”).

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as five thousand dollars ($5,000 5,000.00) or imprisonment for as long as 5 five (5) years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than one thousand dollars ($1,000 1,000.00) with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as one thousand dollars ($1,000 1,000.00) or imprisonment for as long as 1 one (1) year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of one thousand dollars ($1,000 1,000.00) for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1552a(I)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material MAXIMUS Human Service, Inc. Child Support Enforcement Services-30th Judicial District is prohibited, willfully discloses disclosed the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than five thousand dollars ($5,0005,000.00). 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer officer, manager or employee of any person Vendor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person Vendor that returns or return information FTI disclosed to such officer officer, manager, or employee can be used only for a the purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as up to Five Thousand Dollars ($5,000 5,000) or imprisonment for as long as 5 five (5) years, or both, together with the costs of prosecution. Such person Vendor shall also notify each such officer officer, manager, and employee that any such unauthorized further future disclosure of returns or return information FTI may also result in an award of civil damages against Vendor, its officers, managers and the officer or employee in an amount not less than One Thousand Dollars ($1,000 1,000) with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections Sections 7213 and 7431 and set forth at 26 CFR C.F.R. 301.6103(n)-1. 2. Each officer officer, manager or employee of any person Vendor to whom returns or return information FTI is or may be disclosed shall be notified in writing by such person Vendor that any return or return information FTI made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material FTI shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Agreement. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as One Thousand Dollars ($1,000 1,000) or imprisonment for as long as 1 up to one (1) year, or both, together with the costs of prosecution. Such person Vendor shall also notify each such officer officer, manager, and employee that any such unauthorized inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of of: (a) One Thousand Dollars ($1,000 1,000) for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable liable; or (b) the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus disclosure, plus, in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section Sections 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor Vendor to inform its officers officers, managers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. §552a. Specifically, 5 U.S.C. §552a(i)(1), which is made applicable to Vendor as contractors of the Attorney General by 5 U.S.C. §552a(m)(1), provides that any officer officer, manager or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than Five Thousand Dollars ($5,000). 4. Prior to Contractor having Granting Vendor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateAttorney General’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s Vendor must maintain its authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the StateAttorney General's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Vendor and its officers and employees should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see Exhibit 4 of IRS Publication 1075 Exhibit 41075, Sanctions for Unauthorized Disclosure, Disclosure and Exhibit 55 of IRS Publication 1075, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Section 10 of IRS Publication 1075, Section 10). For both the initial certification and the annual certificationcertification Vendor shall sign, the Contractor must sign either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such Each officer and employee shall be further notified that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections §§7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to know any unauthorized person constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each Each such officer and employee shall be notified that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section §§ 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateIDR’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's IDR’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will the contractor shall be advised of the provisions of IRCs 7431, IRC §§7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure7213A, and Exhibit 5, Civil Damages for Unauthorized Disclosure)7431. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, 1075 Section 10). For both the initial certification and the annual certification, the Contractor must sign contractor’s employees, agents, and subcontractors shall sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements. The following Purchasing Instrument/Statement of Work (“SOW”) incorporates the terms and conditions of the Iowa Office of the Chief Information Officer Strategic Technology Plan Services Agreement, Contract No. , (“Agreement”) between the State of Iowa, acting by and through the Iowa Office of the Chief Information Officer (“OCIO” or “State”), and corporation organized under the laws of (“Vendor”), dated Purchasing Instrument is between Vendor and the Governmental Entity identified in the signature block, below, and is effective as of the date of last signature below. Capitalized terms not defined herein are as defined in the Agreement. The applicable Governmental Entity and Vendor may be referred to herein individually as a “Party” or collectively as the “Parties.” 1. Executive Summary/Project Scope. Provide a high level summary of the project/Deliverables to be provided pursuant to this Purchasing Instrument and the scope of the project, including, for example: 1.1 A general description of/nature of the Deliverables; 1.2 Special considerations for implementing, configuring, or installing the Deliverables, including any technological considerations or constraints; 1.3 Any other characteristics of this project that must be addressed to ensure the success of the project/provisioning of Deliverables.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the this Contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency entity not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. A. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. B. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. C. Additionally, it is incumbent upon the Contractor Service Provider to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors subcontractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorsubcontractors, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunderthere under, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person a Contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person a Contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each officer or employee of a Contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information FTI is or may be disclosed will be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information FTI is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.Section

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). 10 ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. (4) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having (5) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor officer or employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s A contractor and each officer or employee must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertificationrecertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will a contractor and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certificationrecertifications, the Contractor contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person the Contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person the Contractor that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person the Contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by the Contractor that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each officer or employee of the Contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing by the Contractor that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. (4) Additionally, it is incumbent upon the Contractor to shall inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. (5) Prior to Contractor having access to Federal tax informationFTI, Contractor shall certify that each Contractor officer or employee who will use or other individual with access to or who use Federal tax information FTI on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s authorization to access Federal tax information FTI hereunder shall be contingent upon annual recertificationrecertification that each such officer or employee understands the State’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the State's ’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the State’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See see IRS Publication 10751075 Section 1.8, Section 10Reporting Improper Inspections or Disclosures). For both the initial certification and the annual certificationrecertifications, the Contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such Each officer and employee shall be further notified that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections §§7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to know any unauthorized person constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each Each such officer and employee shall be notified that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section §§ 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateIDR’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's IDR’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will the contractor shall be advised of the provisions of IRCs 7431, IRC §§7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure7213A, and Exhibit 5, Civil Damages for Unauthorized Disclosure)7431. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, 1075 Section 10). For both the initial certification and the annual certification, the Contractor must sign contractor’s employees, agents, and subcontractors shall sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements. THIS Business Associate Agreement (“BAA”) supplements and is made a part of the Agreement (hereinafter, the “Underlying Agreement”) between the Governmental Entities identified in attachment A (the “Agency”) and the Contractor (the “Business Associate”).

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1CFR301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, 4 Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Un-Authorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. A. Each officer or employee officer, employee, and/or subcontractor of any person the Contractor to whom tax returns or tax return information is or may be disclosed will shall be notified in writing by such person the Contractor that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person Contractor shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections Internal Revenue Code (IRC) Sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. B. Each officer or employee of any person officer, employee, and/or subcontractor to whom tax returns or tax return information is or may be disclosed shall be notified in writing by such person Contractor that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to know constitutes may constitute a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person Contractor shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section Sections 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. C. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552aU.S.C.552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State Procuring Agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. Furthermore, the Contractor will inform its officers and employees of the penalties imposed by the HIPAA Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164), and HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164), which provide that any officer or employee of a contractor, who willfully discloses Protected Health Information in any manner to any person not entitled to receive it, may be subject to civil and criminal penalties of up to $50,000 and up to one year imprisonment. 4. Prior to D. Contractor having agrees that granting access to Federal tax information, Contractor shall certify Confidential Information to any individual must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateProcuring Agency’s applicable security policy and procedures for safeguarding Federal tax informationthe Confidential Information. Contractor’s authorization Contractors must maintain authorizations issued to such individuals to access Federal tax information hereunder shall be contingent upon Confidential Information through annual recertification. The initial certification and recertification must be documented and placed in a file for the State's files for Procuring Agency’s review. As part of the certification, certification and at least annually afterwards, Contractor will be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 46, Sanctions IRC Sec. 7431 Civil Damages for Unauthorized Disclosure, Disclosure of Returns and Return Information and Exhibit 5, Civil Damages for IRC Sec. 7213 Unauthorized DisclosureDisclosure of Information). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See per Section 10 of IRS Publication 1075, Section 10.). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.than (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's agency’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such Each officer and employee shall be further notified that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections §§7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to know any unauthorized person constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each Each such officer and employee shall be notified that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section §§ 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateIDR’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's IDR’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will the contractor shall be advised of the provisions of IRCs 7431, IRC §§7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure7213A, and Exhibit 5, Civil Damages for Unauthorized Disclosure)7431. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, 1075 Section 10). For both the initial certification and the annual certification, the Contractor must sign contractor’s employees, agents, and subcontractors shall sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements. The following Special Terms and Conditions/Ancillary Agreement are part of and incorporated into the State of Iowa Endpoint Managed Services Master Agreement, Contract No. 2018 BUS 0104, (“Agreement”) between the State of Iowa, acting by and through the Office of the Chief Information Officer (“OCIO”), and Insight Public Sector, Inc., a corporation organized under the laws of Illinois (“Vendor”). Capitalized terms not defined in this herein are as defined in the Agreement. These Special Terms and Conditions/Ancillary Agreement apply to any Deliverables provided to the Governmental Entities identified in attachment A hereto. THIS Business Associate Agreement (“BAA”) supplements and is made a part of the Agreement (hereinafter, the “Underlying Agreement”) between the Governmental Entities identified in attachment A (the “Agency”) and the Contractor (the “Business Associate”).

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the this Contract. Inspection by or disclosure to anyone without an official need to need-to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency entity not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.Section

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1552a(m) (1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. a. Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. b. Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . c. Each officer or employee of a contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. d. Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having e. Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor officer or employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s A contractor and each officer or employee must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertificationrecertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will a contractor and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certificationrecertifications, the Contractor contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1301.6103(n)- 1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractParticipating Addendum. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Participating Addendum. Inspection by or disclosure to anyone without an official need to need- to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Granting Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractor must maintain its authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.Exhibit

CRIMINAL/CIVIL SANCTIONS. DRAFT (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Agreement. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor Grantee to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Grantees by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorGrantee, who by virtue of his/her employment or official position, has possession of or access to State MDHHS records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency MDHHS not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.. DRAFT (4. Prior to Contractor having ) Granting a Grantee access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateMDHHS’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Grantees must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the StateMDHHS's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Grantees must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). 7213A. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor Grantee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, 1075 Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. (i) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. (ii) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (iii) Each officer or employee of a contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. (iv) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having (v) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor officer or employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s A contractor and each officer or employee must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertificationrecertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will a contractor and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certificationrecertifications, the Contractor contractor and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. ‌ 1. Each officer or employee of any person NDIT to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person NDIT to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. 3. Such person Each officer or employee of NDIT to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 34. Additionally, it is incumbent upon the Contractor NDIT to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors NDITs by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorNDIT, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 45. Prior to Contractor having Granting NDIT access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor officer or employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax informationFTI. Contractor’s A NDIT and each officer or employee must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertificationrecertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertification recertifications must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will a NDIT and each officer or employee must be advised of the provisions of IRCs 7431, IRC sections 7213, 7213A, and 7213A 7431 (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certificationrecertifications, the Contractor NDIT and each officer or employee must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by Internal Revenue Code (IRC Sections) sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom whomwho returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCsIRC sections 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. section 552a. Specifically, 5 U.S.C. section 552a(i)(1), which is made applicable to contractors by 5 U.S.C. section 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State DCSS records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency DCSS not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify Tax Information (FTI) must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateDCSS’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the StateDCSS's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs IRCsIRC sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person the Contractor to whom returns or return information is or may to be disclosed will be notified in writing by such person the Contractor that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person The Contractor shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections I.R.C. §§ 7213 and 7431 and set forth at 26 CFR § 301.6103(n)-1. (2. ) Each officer or employee of any person the Contractor to whom returns or return information is or may be disclosed shall be notified in writing by such person the Contractor that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person Contractor shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section I.R.C. §§ 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its such officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. § 552a. Specifically, 5 U.S.C. § 552a(i)(1), which is made applicable to contractors by 5 U.S.C. § 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State DHS records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s DHS’ security policy and procedures for safeguarding Federal tax IRS information. Contractor’s The Contractor must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's files for reviewprovided to DHS. As part of the certification, certification and at least annually afterwards, the Contractor will must be advised of the provisions of IRCs I.R.C. §§ 7431, 7213, and 7213A (see IRS Publication Pub 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom who returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State DCSS records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency DCSS not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify Tax Information (FTI) must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateDCSS’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the StateDCSS's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1301 .6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorcontractor , who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having (i) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s agency's security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors should be advised of the provisions of IRCs IRC Sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). 7213A. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor must sign contractor should sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC Internal Revenue Code (IRC) sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom who returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section sections 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. section 552a. Specifically, 5 U.S.C. section 552a(i)(1), which is made applicable to contractors by 5 U.S.C. section 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State DCSS records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency DCSS not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateDCSS’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the StateDCSS's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs IRC sections 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10)breaches. For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors Contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to ) Granting a Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, certification and at least annually afterwards, Contractor will Contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person that returns or return information FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person a contractor to whom returns or return information FTI is or may be disclosed accessible shall be notified in writing by that FTI accessible to such person that any return officer or return information made available in any format shall employee may be used accessed only for a purpose and to the purpose extent authorized herein, and that access/inspection of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone FTI without an official need to need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person . (3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall also notify each such officer and employee be notified in writing that any such unauthorized access, inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection access, inspection, or disclosure with respect to which such defendant is found liable disclosure, or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection access, inspection, or disclosure disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs cost of the action. These penalties are prescribed by IRC section sections 7213, 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. (2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974of1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. (4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Exhibit 4 of Publication 1075 Exhibit 41075, Sanctions for Unauthorized Disclosure, and Exhibit 55 of Publication 1075, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Section 10 of Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. ) Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such Each officer and employee shall be further notified that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections §§7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. ) Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractAgreement. Inspection by or disclosure to anyone without an official need to know any unauthorized person constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each Each such officer and employee shall be notified that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section §§ 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. ) Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having ) Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the StateIDR’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the State's IDR’s files for review. As part of the certification, certification and at least annually afterwards, Contractor will the contractor shall be advised of the provisions of IRCs 7431, IRC §§7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure7213A, and Exhibit 5, Civil Damages for Unauthorized Disclosure)7431. The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, 1075 Section 10). For both the initial certification and the annual certification, the Contractor must sign contractor’s employees, agents, and subcontractors shall sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements. The following Special Terms and Conditions/Ancillary Agreement are part of and incorporated into the State of Iowa and CSDC Master Software, Services, and Equipment Agreement, Contract Number 2019BUS228, between the State of Iowa, acting by and through the Office of the Chief Information Officer (“State of Iowa” or “State”), and CSDC Inc., a corporation organized under the laws of Delaware (“Vendor”); The parties may be referred to herein individually as a “Party” or collectively as the “Parties”; provided, however, that where the context clearly requires, the term “Party” or “Parties” may refer to or include the Governmental Entity making the individual, relevant purchase(s) under the Agreement. Capitalized terms not defined in this herein are as defined in the Agreement. State of Iowa Business Associate Agreement‌ THIS Business Associate Agreement (“BAA”) supplements and is made a part of the Agreement (hereinafter, the “Underlying Agreement”) between the Governmental Entities identified in attachment A (the “Agency”) and the Contractor (the “Business Associate”).

CRIMINAL/CIVIL SANCTIONS. 1. 19.2.1 Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person Contractor that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five (5) years, or both, together with the costs of prosecution. Such person Contractor shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections Internal Revenue Code (IRC) Sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. 19.2.2 Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person Contractor that any return returns or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Agreement. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 one (1) year, or both, together with the costs of prosecution. Such person Contractor shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section Sections 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information DocuSign Envelope ID: E3DE512C-D01A-4398-A3A1-9B346D4FF8F4 for a purpose or to an extent unauthorized herein constitutes a felony punishable upon punishableupon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractParticipating Addendum. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Participating Addendum. Inspection by or disclosure to anyone without an official need to need- to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorContractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Granting Contractor having access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractor must maintain its authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). 10 ) For both the initial certification and the annual certification, the Contractor must sign sign, DocuSign Envelope ID: E3DE512C-D01A-4398-A3A1-9B346D4FF8F4 either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five (5) years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor County Attorney to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors County Attorneys by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractorCounty Attorney, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in agency will have the State's files for review. As part of right to void the certification, and at least annually afterwards, Contractor will be advised of contract if the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before County Attorney fails to provide the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirementssafeguards described above.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractcontract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. 17.2.1 Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. 17.2.2 Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. 17.2.3 Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person Special Counsel and/or Firm to whom returns or return information FTI is or may be disclosed will shall be notified in writing by such person Special Counsel and/or Firm that returns or return information FTI disclosed to such officer or employee can be used only for a the purpose and to the extent authorized herein, and that further disclosure of any such returns or return information FTI for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as Five Thousand Dollars ($5,000 5,000) or imprisonment for as long as 5 up to five years, or both, together with the costs of prosecution. Such person Special Counsel and/or Firm shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information FTI may also result in an award of civil damages against Special Counsel, Firm and the officer or employee in an amount not less than One Thousand Dollars ($1,000 1,000) with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections Sections 7213 and 7431 and set forth at in 26 CFR C.F.R. 301.6103(n)-1. 2. Each officer or employee of any person Special Counsel and/or Firm to whom returns or return information FTI is or may be disclosed shall be notified in writing by such person Special Counsel and/or Firm that any return or return information FTI made available in any format shall be used only for the purpose of carrying out the provisions of this ContractAgreement. Information contained in such material FTI shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis Agreement. Inspection by or disclosure to anyone without an official need to need- to- know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as One Thousand Dollars ($1,000 1,000) or imprisonment for as long as 1 one year, or both, together with the costs of prosecution. Such person Special Counsel and/or Firm shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of of: (a) One Thousand Dollars ($1,000 1,000) for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable liable; or (b) the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus disclosure, plus, in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, damages plus the costs of the action. These The penalties are prescribed by IRC section Sections 7213A and 7431, 7431 and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor Special Counsel and Firm to inform his/her/ its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. §552a. Specifically, 5 U.S.C. §552a(i)(1), which is made (applicable to Special Counsel and Firm as contractors of the Attorney General by 5 U.S.C. §552a(m)(1), ) provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than Five Thousand Dollars ($5,000). 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will shall be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 five years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further future disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections IRCs 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contractcontract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contractthis contract. Inspection by or disclosure to anyone without an official need to need-to-know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 1,000.00 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee [United States for Federal employees] in an amount equal to the sum of the greater of $1,000 1,000.00 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These The penalties are prescribed by IRC section IRCs 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having Granting a contractor access to Federal tax information, Contractor shall certify FTI must be preceded by certifying that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the Stateagency’s security policy and procedures for safeguarding Federal tax IRS information. Contractor’s Contractors must maintain their authorization to access Federal tax information hereunder shall be contingent upon FTI through annual recertification. The initial certification and recertification must be documented and placed in the Stateagency's files for review. As part of the certification, certification and at least annually afterwards, Contractor will contractors must be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches breaches. (See Publication 1075, Section 10). ) For both the initial certification and the annual certification, the Contractor contractor must sign sign, either with ink or electronic signature, a confidentiality statement certifying its their understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s Cont authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. (1. ) Each officer or employee of any person the COUNTY to whom federal tax returns or return information is or may be disclosed will be notified in writing by such person the COUNTY that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person The COUNTY shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR C.F.R., section 301.6103(n)-1. (2. ) Each officer or employee of any person the COUNTY to whom federal tax returns or return information is disclosed or may be disclosed shall be notified in writing by such person the COUNTY that any federal tax return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this ContractCooperative Agreement. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the ContractCooperative Agreement. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person The COUNTY shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section Internal Revenue Code sections 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1. (3. ) Additionally, it is incumbent upon the Contractor COUNTY to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. section 552a. Specifically, 5 U.S.C. U.S.C., section 552a(i)(1), which is made applicable to contractors COUNTY by 5 U.S.C. U.S.C., section 552a(m)(1), provides that any officer or employee of a contractorCOUNTY, who by virtue of his/her employment or official position, has possession of or access to State agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunderhereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.

CRIMINAL/CIVIL SANCTIONS. 1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1. 2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431, and set forth at 26 CFR 301.6103(n)-1.7431.‌ 3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 4. Prior to Contractor having access to Federal tax information, Contractor shall certify that each Contractor employee or other individual with access to or who use Federal tax information on Contractor’s behalf pursuant to this Contract understands the State’s security policy and procedures for safeguarding Federal tax information. Contractor’s authorization to access Federal tax information hereunder shall be contingent upon annual recertification. The initial certification and recertification must be documented and placed in the State's files for review. As part of the certification, and at least annually afterwards, Contractor will be advised of the provisions of IRCs 7431, 7213, and 7213A (see IRS Publication 1075 Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches (See Publication 1075, Section 10). For both the initial certification and the annual certification, the Contractor must sign a confidentiality statement certifying its understanding of the security requirements.