Breach Notification a. In the event of a Breach of unsecured PHI or disclosure that compromises the privacy or security of PHI obtained from DSHS or involving DSHS clients, Business Associate will take all measures required by state or federal law.
b. Business Associate will notify DSHS within one (1) business day by telephone and in writing of any acquisition, access, Use or disclosure of PHI not allowed by the provisions of this Contract or not authorized by HIPAA Rules or required by law of which it becomes aware which potentially compromises the security or privacy of the Protected Health Information as defined in 45 CFR 164.402 (Definitions).
c. Business Associate will notify the DSHS Contact shown on the cover page of this Contract within one (1) business day by telephone or e-mail of any potential Breach of security or privacy of PHI by the Business Associate or its Subcontractors or agents. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the Breach, to include the following: date and time of the Breach, date Breach was discovered, location and nature of the PHI, type of Breach, origination and destination of PHI, Business Associate unit and personnel associated with the Breach, detailed description of the Breach, anticipated mitigation steps, and the name, address, telephone number, fax number, and e-mail of the individual who is responsible as the primary point of contact. Business Associate will address communications to the DSHS Contact. Business Associate will coordinate and cooperate with DSHS to provide a copy of its investigation and other information requested by DSHS, including advance copies of any notifications required for DSHS review before disseminating and verification of the dates notifications were sent.
d. If DSHS determines that Business Associate or its Subcontractor(s) or agent(s) is responsible for a Breach of unsecured PHI:
(1) requiring notification of Individuals under 45 CFR § 164.404 (Notification to Individuals), Business Associate bears the responsibility and costs for notifying the affected Individuals and receiving and responding to those Individuals’ questions or requests for additional information;
(2) requiring notification of the media under 45 CFR § 164.406 (Notification to the media), Business Associate bears the responsibility and costs for notifying the media and receiving and responding to media questions or requests for additional information;
(3) requiring notification of the U.S. Department of Health and Human Services Secretary under 45 CFR § 164.408 (Notification to the Secretary), Business Associate bears the responsibility and costs for notifying the Secretary and receiving and responding to the Secretary’s questions or requests for additional information; and
(4) DSHS will take appropriate remedial measures up to termination of this Contract.
Security Breach Notification In addition to the information enumerated in Article V, Section 4(1) of the DPA Standard Clauses, any Security Breach notification provided by the Provider to the LEA shall include:
a. A list of the students whose Student Data was involved in or is reasonably believed to have been involved in the breach, if known; and
b. The name and contact information for an employee of the Provider whom parents may contact to inquire about the breach.
Personal Data Breach Notification SAP will notify Customer without undue delay after becoming aware of any Personal Data Breach and provide reasonable information in its possession to assist Customer to meet Customer’s obligations to report a Personal Data Breach as required under Data Protection Law. SAP may provide such information in phases as it becomes available. Such notification shall not be interpreted or construed as an admission of fault or liability by SAP.
Incident Response Operator shall have a written incident response plan that reflects best practices and is consistent with industry standards and federal and state law for responding to a data breach, breach of security, privacy incident or unauthorized acquisition or use of any portion of Data, including PII, and agrees to provide LEA, upon request, an executive summary of the written incident response plan.
Handling Sensitive Personal Information and Breach Notification A. As part of its contract with HHSC Contractor may receive or create sensitive personal information, as section 521.002 of the Business and Commerce Code defines that phrase. Contractor must use appropriate safeguards to protect this sensitive personal information. These safeguards must include maintaining the sensitive personal information in a form that is unusable, unreadable, or indecipherable to unauthorized persons. Contractor may consult the “Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals” issued by the U.S. Department of Health and Human Services to determine ways to meet this standard.
B. Contractor must notify HHSC of any confirmed or suspected unauthorized acquisition, access, use or disclosure of sensitive personal information related to this Contract, including any breach of system security, as section 521.053 of the Business and Commerce Code defines that phrase. Contractor must submit a written report to HHSC as soon as possible but no later than 10 business days after discovering the unauthorized acquisition, access, use or disclosure. The written report must identify everyone whose sensitive personal information has been or is reasonably believed to have been compromised.
C. Contractor must either disclose the unauthorized acquisition, access, use or disclosure to everyone whose sensitive personal information has been or is reasonably believed to have been compromised or pay the expenses associated with HHSC doing the disclosure if:
1. Contractor experiences a breach of system security involving information owned by HHSC for which disclosure or notification is required under section 521.053 of the Business and Commerce Code; or
2. Contractor experiences a breach of unsecured protected health information, as 45 C.F.R. §164.402 defines that phrase, and HHSC becomes responsible for doing the notification required by 45 C.F.R. §164.404. HHSC may, at its discretion, waive Contractor's payment of expenses associated with HHSC doing the disclosure.
Security Breach Notice and Reporting The Contractor shall have policies and procedures in place for the effective management of Security Breaches, as defined below, which shall be made available to the State upon request.
BREACH DISCOVERY AND NOTIFICATION 17 1. Following the discovery of a Breach of Unsecured PHI, CONTRACTOR shall notify 18 COUNTY of such Breach, however both parties agree to a delay in the notification if so advised by a 19 law enforcement official pursuant to 45 CFR § 164.412.
20 a. A Breach shall be treated as discovered by CONTRACTOR as of the first day on which 21 such Breach is known to CONTRACTOR or, by exercising reasonable diligence, would have been 22 known to CONTRACTOR.
23 b. CONTRACTOR shall be deemed to have knowledge of a Breach, if the Breach is 24 known, or by exercising reasonable diligence would have known, to any person who is an employee, 25 officer, or other agent of CONTRACTOR, as determined by federal common law of agency.
26 2. CONTRACTOR shall provide the notification of the Breach immediately to the COUNTY 27 Privacy Officer. CONTRACTOR’s notification may be oral, but shall be followed by written 28 notification within twenty four (24) hours of the oral notification.
29 3. CONTRACTOR’s notification shall include, to the extent possible:
30 a. The identification of each Individual whose Unsecured PHI has been, or is reasonably 31 believed by CONTRACTOR to have been, accessed, acquired, used, or disclosed during the Breach;
32 b. Any other information that COUNTY is required to include in the notification to 33 Individual under 45 CFR §164.404 (c) at the time CONTRACTOR is required to notify COUNTY or 34 promptly thereafter as this information becomes available, even after the regulatory sixty (60) day 35 period set forth in 45 CFR § 164.410 (b) has elapsed, including:
36 1) A brief description of what happened, including the date of the Breach and the date 37 of the discovery of the Breach, if known;
1 2) A description of the types of Unsecured PHI that were involved in the Breach (such 2 as whether full name, social security number, date of birth, home address, account number, diagnosis, 3 disability code, or other types of information were involved);
4 3) Any steps Individuals should take to protect themselves from potential harm 5 resulting from the Breach;
6 4) A brief description of what CONTRACTOR is doing to investigate the Breach, to 7 mitigate harm to Individuals, and to protect against any future Breaches; and
8 5) Contact procedures for Individuals to ask questions or learn additional information, 9 which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.
10 4. COUNTY may require CONTRACTOR to provide notice to the Individual as required in 11 45 CFR § 164.404, if it is reasonable to do so under the circumstances, at the sole discretion of the 12 COUNTY.
13 5. In the event that CONTRACTOR is responsible for a Breach of Unsecured PHI in violation 14 of the HIPAA Privacy Rule, CONTRACTOR shall have the burden of demonstrating that 15 CONTRACTOR made all notifications to COUNTY consistent with this Subparagraph F and as 16 required by the Breach notification regulations, or, in the alternative, that the acquisition, access, use, or 17 disclosure of PHI did not constitute a Breach.
18 6. CONTRACTOR shall maintain documentation of all required notifications of a Breach or 19 its risk assessment under 45 CFR § 164.402 to demonstrate that a Breach did not occur.
20 7. CONTRACTOR shall provide to COUNTY all specific and pertinent information about the 21 Breach, including the information listed in Section E.3.b.(1)-(5) above, if not yet provided, to permit 22 COUNTY to meet its notification obligations under Subpart D of 45 CFR Part 164 as soon as 23 practicable, but in no event later than fifteen (15) calendar days after CONTRACTOR’s initial report of 24 the Breach to COUNTY pursuant to Subparagraph F.2. above.
25 8. CONTRACTOR shall continue to provide all additional pertinent information about the
Client Responsibility For clarity, the parties agree that in reviewing the documents referred to in clause (b) above, Patheon’s role will be limited to verifying the accuracy of the description of the work undertaken or to be undertaken by Patheon. Subject to the foregoing, Patheon will not assume any responsibility for the accuracy of any application for receipt of an approval by a Regulatory Authority. The Client is solely responsible for the preparation and filing of the application for approval by the Regulatory Authority and any relevant costs will be borne by the Client.
Employer Responsibility The Employer accepts its responsibility to insure equal opportunity in all aspects of employment for all qualified persons regardless of race, creed, religion, color, national origin, age, disability, reliance on public assistance, sex, marital status, sexual orientation/affectional preference, or any other class or group distinction, as set forth by state or federal anti-discrimination laws, or in Board policy.
NOTICE TO MEMBERS REGARDING ATTRIBUTE RESPONSES TIPS VENDORS RESPOND TO ATTRIBUTE QUESTIONS AS PART OF TIPS COMPETITIVE SOLICITATION PROCESS. THE VENDOR’S RESPONSES TO ATTRIBUTE QUESTIONS ARE INCLUDED HEREIN AS “SUPPLIER RESPONSE.” PLEASE BE ADVISED THAT DEVIATIONS, IF ANY, IN VENDOR’S RESPONSE TO ATTRIBUTE QUESTIONS MAY NOT REFLECT VENDOR’S FINAL ATTRIBUTE RESPONSE, WHICH IS SUBJECT TO NEGOTIATIONS PRIOR TO AWARD. PLEASE CONTACT THE TIPS OFFICE AT 866-839- 8477 WITH QUESTIONS OR CONCERNS REGARDING VENDOR ATTRIBUTE RESPONSE DEVIATIONS. PLEASE KEEP IN MIND THAT TIPS DOES NOT PROVIDE LEGAL COUNSEL TO MEMBERS. TIPS RECOMMENDS THAT YOU CONSULT YOUR LEGAL COUNSEL WHEN EXECUTING CONTRACTS WITH OR MAKING PURCHASES FROM TIPS VENDORS. Number: 220105 Addendum 1 Title: Technology Solutions, Products and Services Type: Request for Proposal Issue Date: 1/6/2022 Deadline: 2/18/2022 03:00 PM (CT) Notes: I F YO U ALREAD Y HOL D TIP S CONTRAC T 200105 TECHNOLOGY SOLUTIONS, PRODUCTS AND SERVICES (“200105”) OR 210101 TECHNOLOGY SOLUTIONS, PRODUCTS AND SERVICES ("210101"), YOU DO NOT NEED TO RESPOND TO THIS SOLICITATION UNLESS YOU WISH TO REPLACE 200105 OR 210101 AT THIS TIME. IF YOU HOLD 200105 OR ꞏ TIPS 190103 Web and Cloud Computing Services ꞏ TIPS 181203 Management Software and Services ꞏ TIPS 181204 Notification Systems Address: Region 8 Education Service Center 0000 XX Xxxxxxx 000 Xxxxx Xxxxxxxxx, XX 00000 Phone: +0 (000) 000-0000 Email: xxxx@xxxx-xxx.xxx Address: 000 X XXX 00 Xxxxx 00 Xxxxxxxxxx, XX 00000 Phone: (000) 000-0000 Web Address: xxxxxxxxxxxxx.xxx By submitting your response, you certify that you are authorized to represent and bind your company. If you have not taken exception or deviation to the agreement language in the solicitation attributes, download the AGREEMENT SIGNATURE FORM from the "ATTACHMENTS" tab. This PDF document is a fillable form. Download the document to your computer, fill in the requested company information, print the file, SIGN the form, SCAN the completed and signed AGREEMENT SIGNATURE FORM, and upload here. If you have taken exception to any of the agreement language and noted the exception in the deviations section of the attributes for the agreement, complete the AGREEMENT SIGNATURE FORM, but DO NOT SIGN until those deviations have been negotiated and resolved with TIPS management. Upload the unsigned form here, because this is a required document. All Other Certificates (if applicable) must be scanned and uploaded. If vendor has more than one other certification scan into one document. (PDF Format ONLY) DO NOT UPLOAD encrypted or password protected files. The vendor must download the PRICING SPREADSHEET SHEET from the attachment tab, fill in the requested information and upload the completed spreadsheet. DO NOT UPLOAD encrypted or password protected files.
