Confidentiality of State Information In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.
