Investigation of Breach and Security Incidents. The Contractor shall immediately investigate such breach or security incident. As soon as the information is known and subject to the legitimate needs of law enforcement, Contractor shall inform the DSH Program Contract Manager, the DSH Privacy Officer, and the DSH Chief Information Security Officer of:
1. what data elements were involved, and the extent of the data disclosure or access involved in the breach, including, specifically, the number of individuals whose personal information was breached; and
2. a description of the unauthorized persons known or reasonably believed to have improperly used the DSH PCI and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the DSH PCI, or to whom it is known or reasonably believed to have had the DSH PCI improperly disclosed to them; and
3. a description of where the DSH PCI is believed to have been improperly used or disclosed; and
4. a description of the probable and proximate causes of the breach or security incident; and
Investigation of Breach and Security Incidents. The Agency shall immediately investigate such breach or security incident. As soon as the information is known and shall inform the City of:
i. what data elements were involved, and the extent of the data disclosure or access involved in the breach, including, specifically, the number of individuals whose personal information was breached; and
ii. a description of the unauthorized persons known or reasonably believed to have improperly used the City Data and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the City Data, or to whom it is known or reasonably believed to have had the City Data improperly disclosed to them; and
iii. a description of where the City Data is believed to have been improperly used or disclosed; and
iv. a description of the probable and proximate causes of the breach or security incident; and
v. whether any federal or state laws requiring individual notifications of breaches have been triggered.
Investigation of Breach and Security Incidents. Blue Shield shall immediately investigate such Breach or Security Incident. As soon as the information is known, and subject to the legitimate needs of law enforcement, Blue Shield shall inform the Agency Contract Manager, the CDPH Privacy Officer, and the CDPH Chief Information Security Officer of:
1. what data elements were involved and the extent of the data unauthorized Use or Disclosure involved in the Breach or Security Incident, including, specifically, the number of individuals whose CDPH PCI was breached; and
2. a description of the unauthorized persons known or reasonably believed to have improperly Used or Disclosed the CDPH PCI, and/or to the persons whom it is known or reasonably believed to have had the CDPH PCI improperly Disclosed to them; and
3. a description of where the CDPH PCI is believed to have been improperly Used or Disclosed; and
Investigation of Breach and Security Incidents. The Applicant shall immediately investigate such breach or security incident. As soon as the information is known and subject to the legitimate needs of law enforcement, Applicant shall inform the CDPH Program Contract Manager, the CDPH Privacy Officer, and the CDPH Chief Information Security Officer of:
1. what data elements were involved, and the extent of the data disclosure or access involved in the breach, including, specifically, the number of individuals whose personal information was breached; and
2. a description of the unauthorized persons known or reasonably believed to have improperly used the CDPH PCI and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the CDPH PCI, or to whom it is known or reasonably believed to have had the CDPH PCI improperly disclosed to them; and
3. a description of where the CDPH PCI is believed to have been improperly used or disclosed; and
4. a description of the probable and proximate causes of the breach or security incident; and
5. whether Civil Code section 1798.29 or any other federal or state laws requiring individual notifications of breaches have been triggered.
Investigation of Breach and Security Incidents. The Contractor shall immediately investigate such breach or security incident. As soon as the information is known and subject to the legitimate needs of law enforcement, Contractor shall inform the CDPH Program Contract Manager, the CDPH Privacy Officer, and the CDPH Chief Information Security Officer of:
1. what data elements were involved and the extent of the data disclosure or access involved in the breach, including, specifically, the number of individuals whose personal information was breached; and
2. a description of the unauthorized persons known or reasonably believed to have improperly used the CDPH PCI and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the CDPH PCI, or to whom it is known or reasonably believed to have had the CDPH PCI improperly disclosed to them; and
3. a description of where the CDPH PCI is believed to have been improperly used or disclosed; and CDPH IPSR (10/19)
