Access to Protected Information If BA maintains a designated record set on behalf of CE, BA shall make Protected Information maintained by BA or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within five (5) days of a request by CE to enable CE to fulfill its obligations under state law [Health and Safety Code Section 123110] and the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.524 [45 C.F.R. Section 164.504(e)(2)(ii)(E)]. If BA maintains Protected Information in electronic format, BA shall provide such information in electronic format as necessary to enable CE to fulfill its obligations under the HITECH Act and HIPAA Regulations, including, but not limited to, 42 U.S.C. Section 17935(e) and 45 C.F.R. Section 164.524.
Security of Information Unless otherwise specifically authorized by the DOH Chief Information Security Officer, Contractor receiving confidential information under this contract assures that: • Encryption is selected and applied using industry standard algorithms validated by the National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program against all information stored locally and off-site. Information must be encrypted both in-transit and at rest and applied in such a way that it renders data unusable to anyone but authorized personnel, and the confidential process, encryption key or other means to decipher the information is protected from unauthorized access. • It is compliant with the applicable provisions of the Washington State Office of the Chief Information Officer (OCIO) policy 141, Securing Information Technology Assets, available at: xxxxx://xxxx.xx.xxx/policy/securing-information-technology-assets. • It will provide DOH copies of its IT security policies, practices and procedures upon the request of the DOH Chief Information Security Officer. • DOH may at any time conduct an audit of the Contractor’s security practices and/or infrastructure to assure compliance with the security requirements of this contract. • It has implemented physical, electronic and administrative safeguards that are consistent with OCIO security standard 141.10 and ISB IT guidelines to prevent unauthorized access, use, modification or disclosure of DOH Confidential Information in any form. This includes, but is not limited to, restricting access to specifically authorized individuals and services through the use of: o Documented access authorization and change control procedures; o Card key systems that restrict, monitor and log access; o Locked racks for the storage of servers that contain Confidential Information or use AES encryption (key lengths of 256 bits or greater) to protect confidential data at rest, standard algorithms validated by the National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program (CMVP); o Documented patch management practices that assure all network systems are running critical security updates within 6 days of release when the exploit is in the wild, and within 30 days of release for all others; o Documented anti-virus strategies that assure all systems are running the most current anti-virus signatures within 1 day of release; o Complex passwords that are systematically enforced and password expiration not to exceed 120 days, dependent user authentication types as defined in OCIO security standards; o Strong multi-factor authentication mechanisms that assure the identity of individuals who access Confidential Information; o Account lock-out after 5 failed authentication attempts for a minimum of 15 minutes, or for Confidential Information, until administrator reset; o AES encryption (using key lengths 128 bits or greater) session for all data transmissions, standard algorithms validated by NIST CMVP; o Firewall rules and network address translation that isolate database servers from web servers and public networks; o Regular review of firewall rules and configurations to assure compliance with authorization and change control procedures; o Log management and intrusion detection/prevention systems; o A documented and tested incident response plan Any breach of this clause may result in termination of the contract and the demand for return of all personal information.
Protected Information 5.3.1 In this Section "Protected Information" means:
Security of Confidential Information Each party possessing Confidential Information of the other party will maintain all such Confidential Information under secure conditions, using reasonable security measures and in any event not less than the same security procedures used by such party for the protection of its own Confidential Information of a similar kind.
Confidentiality of Protected Data (a) Vendor acknowledges that the Protected Data it receives pursuant to the Master Agreement originates from the District and that this Protected Data belongs to and is owned by the District.
(b) Vendor will maintain the confidentiality of the Protected Data it receives in accordance with federal and state law (including but not limited to Section 2-d) and the District’s policy on data security and privacy. The District will provide Vendor with a copy of its policy on data security and privacy upon request.
Use and Disclosure of Protected Health Information The Business Associate must not use or further disclose protected health information other than as permitted or required by the Contract or as required by law. The Business Associate must not use or further disclose protected health information in a manner that would violate the requirements of HIPAA Regulations.
Confidential Information Protections 4.1 At all times during and after the Employee’s employment, the Employee will hold in confidence and will not disclose, use, lecture upon, or publish any of Company’s Confidential Information (defined below), except as may be required in connection with the Employee’s work for Company, or as expressly authorized by the Board. The Employee will obtain the written approval of the Board before publishing or submitting for publication any material (written, oral, or otherwise) that relates to the Employee’s work at Company and/or incorporates any Confidential Information. The Employee hereby assigns to Company any rights the Employee may have or acquire in any and all Confidential Information and recognize that all Confidential Information shall be the sole and exclusive property of Company and its assigns.
Amendment of Protected Health Information 8.1 To the extent Covered Entity determines that any Protected Health Information is maintained by Business Associate or its agents or Subcontractors in a Designated Record Set, Business Associate shall, within ten (10) business days after receipt of a written request from Covered Entity, make any amendments to such Protected Health Information that are requested by Covered Entity, in order for Covered Entity to meet the requirements of 45 C.F.R. § 164.526.
8.2 If any Individual requests an amendment to Protected Health Information directly from Business Associate or its agents or Subcontractors, Business Associate shall notify Covered Entity in writing within five (5) days of the receipt of the request. Whether an amendment shall be granted or denied shall be determined by Covered Entity.
CONFIDENTIAL NATURE OF DOCUMENTS AND INFORMATION Information and data that is considered proprietary by either Party, and that is delivered or disclosed by one Party (“Discloser”) to the other Party (“Recipient”) during the course of performance of the Contract, and that is designated as confidential (“Information”), shall be held in confidence by that Party and shall be handled as follows:
13.1 The recipient (“Recipient”) of such information shall:
13.1.1 use the same care and discretion to avoid disclosure, publication or dissemination of the Discloser’s Information as it uses with its own similar information that it does not wish to disclose, publish or disseminate; and,
13.1.2 use the Discloser’s Information solely for the purpose for which it was disclosed.
13.2 Provided that the Recipient has a written agreement with the following persons or entities requiring them to treat the Information confidential in accordance with the Contract and this Article 13, the Recipient may disclose Information to:
13.2.1 any other party with the Discloser’s prior written consent; and,
13.2.2 the Recipient’s employees, officials, representatives and agents who have a need to know such Information for purposes of performing obligations under the Contract, and employees officials, representatives and agents of any legal entity that it controls, controls it, or with which it is under common control, who have a need to know such Information for purposes of performing obligations under the Contract, provided that, for these purposes a controlled legal entity means:
13.2.2.1 a corporate entity in which the Party owns or otherwise controls, whether directly or indirectly, over fifty percent (50%) of voting shares thereof; or,
13.2.2.2 any entity over which the Party exercises effective managerial control; or,
13.2.2.3 for the UNDP, an affiliated Fund such as UNCDF, UNIFEM and UNV.
13.3 The Contractor may disclose Information to the extent required by law, provided that, subject to and without any waiver of the privileges and immunities of the United Nations, the Contractor will give the UNDP sufficient prior notice of a request for the disclosure of Information in order to allow the UNDP to have a reasonable opportunity to take protective measures or such other action as may be appropriate before any such disclosure is made.
13.4 The UNDP may disclose Information to the extent as required pursuant to the Charter of the UN, resolutions or regulations of the General Assembly, or rules promulgated by the Secretary-General.
13.5 The Recipient shall not be precluded from disclosing Information that is obtained by the Recipient from a third party without restriction, is disclosed by the Discloser to a third party without any obligation of confidentiality, is previously known by the Recipient, or at any time is developed by the Recipient completely independently of any disclosures hereunder.
13.6 These obligations and restrictions of confidentiality shall be effective during the term of the Contract, including any extension thereof, and, unless otherwise provided in the Contract, shall remain effective following any termination of the Contract.
Security of Data a. Each of the parties shall:
i. ensure as far as reasonably practicable, that Data is properly stored, is not accessible to unauthorised persons, is not altered, lost or destroyed and is capable of being retrieved only by properly authorised persons;
ii. subject to the provisions of Sub-Clause 8.a. ensure that, in addition to any security, proprietary and other information disclosure provision contained in the Contract, Messages and Associated Data are maintained in confidence, are not disclosed or transmitted to any unauthorised person and are not used for any purpose other than that communicated by the sending party or permitted by the Contract; and
iii. protect further transmission to the same degree as the originally transmitted Message and Associated Data when further transmissions of Messages and Associated Data are permitted by the Contract or expressly authorised by the sending party.
b. The sending party shall ensure that Messages are marked in accordance with the requirements of the Contract. If a further transmission is made pursuant to Sub-Clause 3. a. iii. the sender shall ensure that such markings are repeated in the further transmission.
c. The parties may apply special protection to Messages by encryption or by other agreed means, and may apply designations to the Messages for protective Interchange, handling and storage procedures. Unless the parties otherwise agree, the party receiving a Message so protected or designated shall use at least the same level of protection and protective procedures for any further transmission of the Message and its Associated Data for all responses to the Message and for all other communications by Interchange or otherwise to any other person relating to the Message.
d. If either party becomes aware of a security breach or breach of confidence in relation to any Message or in relation to its procedures or systems (including, without limitation, unauthorised access to their systems for generation, authentication, authorisation, processing, transmission, storage, protection and file management of Messages) then it shall immediately inform the other party of such breach. On being informed or becoming aware of a breach the party concerned shall:
i. immediately investigate the cause, effect and extent of such breach;
ii. report the results of the investigation to the other party; and
iii. use all reasonable endeavours to rectify the cause of such breach.
e. Each party shall ensure that the contents of Messages that are sent or received are not inconsistent with the law, the application of which could restrict the content of a Message or limit its use, and shall take all necessary measures to inform without delay the other party if such an inconsistency arises.
