Laserfiche WebLink
6.1.C. - Page 27 <br />2. Contractor shall protect from unauthorized disclosure names and other <br />identifying information, concerning persons receiving services pursuant <br />to this Agreement, except for statistical information not identifying any <br />participant. <br />3. "Identifying information" shall include, but not be limited to, name, <br />identifying number, social security number, state driver's license or state <br />identification number, financial account numbers, symbol or other <br />identifying characteristic assigned to the individual, such as finger or voice <br />print or a photograph. <br />4. Contractor shall not use such identifying information in paragraph 3 above <br />for any purpose other than carrying out Contractor's obligations under this <br />Agreement. <br />5. Contractor shall not, except as otherwise specifically authorized or <br />required by this Agreement or court order, disclose any identifying <br />information obtained under the terms of this Agreement to anyone other <br />than County without prior written authorization from County. Contractor <br />may be authorized, in writing, by a participant to disclose identifying <br />information specific to the authorizing participant. <br />D. Health Insurance Portability and Accountability Act (HIPAA) <br />Contractor agrees to comply with the privacy and security requirement of the <br />HIPAA to the extent applicable and to take all reasonable efforts to implement <br />HIPAA requirements. Contractor will make reasonable efforts to ensure that <br />subcontractors comply with the privacy and security requirements of HIPAA. <br />31. Securitv Incident Reportinq <br />A security incident occurs when information assets are accessed, modified, destroyed, <br />or disclosed without proper authorization, or are lost or stolen. Contractor must report all <br />security incidents to BHRS immediately upon detection. <br />32. Notification of Securitv Breach to Data Subiects <br />A. Notice must be given by Contractor to County and any data subject whose <br />personal information could have been breached. <br />B. Notice must be given in the most expedient time possible and without <br />unreasonable delay except when notification would impede a criminal <br />investigation or when necessary measures to restore system integrity are <br />required. <br />24 <br />REV: 01-17-18 RL <br />ATTY/AGR/2018.012/COUNTY OF SAN MATEO <br />