Agmt17 Brainfuse, Inc. - Laserfiche WebLink

Browse Search

law, if it confirms that there is, or reasonably believes that there has been a Data Breach. Brainfuse shall (1) cooperate with the Library as reasonably requested by the Library to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post -incident review of events and actions taken to make changes in business practices in providing the services, if necessary. iii. Unless otherwise stipulated, if a Data Breach is a direct result of Brainfuse's breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, Brainfuse shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by state law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $225 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Brainfuse based on root cause. Section 8.6 Definitions For purposes of this Agreement, the following definitions apply: "Data Breach" means the unauthorized access by a non -authorized person/s that results in the use, disclosure or theft of Library's unencrypted Personal Data or Non -Public Data. ii. "Non -Public Data" means data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the Library because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information. ii. "Personal Data" means data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PII): government -issued identification numbers (e.g., Social Security, driver's license, passport, library account numbers); financial account information, including account number, credit or debit card numbers; or Protected Health Information (PHI) relating to a person. Personal data also means any data pertaining to students who use the Brainf ise Program pursuant to this Agreement, including, without limitation, student work, student names, and student academic records. iv. Protected Health Information" (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. v. "Library Data" means all data created or in any way originating with the Library or any Library student, and all data that is the output of computer processing of or other electronic manipulation of any data that was created by or in any way originated with the Library or Library student, whether such data or output is stored on the Library's hardware, Brainfuse's hardware or exists in any system owned, maintained or otherwise controlled by the Library or by Brainfuse. ATTY/AGR/2017.276/BRAINFUSE, INC. REV: 11-17-17 JS Page 5 of 7