Security and Confidentiality Duties i) Neither the CP nor the HHSC are the Business Associate of the other, as defined by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §1320d, et seq., and regulations adopted under that act. The CP is solely acting on behalf of the people it provides Level II Services to, based on the consent of those individuals described above.
ii) The CP acknowledges that the information it receives based on individual consent for assistance for Level II services is highly confidential and sensitive. Certain HHSC information may also be highly confidential. The CP agrees that the CP, its staff, employees, agents, volunteers and subcontractors providing Services on the CP’s behalf under this agreement will treat all individual and HHSC information received as confidential to the extent that confidential treatment is provided under law and regulations if held by the HHSC.
iii) The CP will access, maintain, retain, modify, record, store, destroy, or otherwise hold, use, or disclose confidential information only in a secure fashion. For purposes of this Agreement, a secure fashion means that the confidential information is rendered unusable, unreadable, or indecipherable to unauthorized persons by either encryption or destruction such that the confidential information cannot be read or otherwise reconstructed. For example the CP will require and ensure all browser activity and history be cleared and deleted between each applicant or recipient the CP assists under Level I or Level II Services, and all paper copies of applicant or recipient information is adequately private and secure.
iv) The CP will immediately report to the HHSC any actual, potential or attempted unauthorized access, use, disclosure, modification, loss or destruction of confidential information, which has the potential for jeopardizing the confidentiality, integrity or availability of the confidential information (collectively an “incident”). The CP will cooperate fully with the HHSC in addressing any such unauthorized acquisition, access, use or disclosure, or suspected or potential unauthorized acquisition, access, use or disclosure of confidential information to the extent and in the manner determined by the HHSC. The obligation of the CP in this regard begin at the discovery of an Incident and continues as long as related activity continues, until all effects of the incident are mitigated, to the HHSC’s satisfaction.
v) The CP will ensure its officers, directors, employees, a...
