Common use of LOSS AND/OR DISCLOSURE OF PERSONALLY Clause in Contracts

LOSS AND/OR DISCLOSURE OF PERSONALLY. IDENTIFIABLE INFORMATION (PII) – NOTIFICATION OF DATA BREACH The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team (IRT) via email (XXX@xxxx.xxx.xxx) within one hour of discovering the incident. The Contractor shall follow up with IRT by completing and submitting one of the applicable two forms below within three (3) work days of incident discovery:‌‌ NIH PII Spillage Report at: xxxxx://xxxx.xxx.xxx/InfoSecurity/Policy/Documents/NIH_PII_Spillage_Proced.doc‌‌ NIH Lost or Stolen Assets Report at: xxxxx://xxxx.xxx.xxx/InfoSecurity/Policy/Documents/ISSO_Stolen_Device-‌ Media_Handling_Procedures.doc (Include subparagraph 5 below in delivery orders when the contractor/subcontractor will host NIH web pages or databases.)