AgdaPkt 2019-06-10 Joint SA PFA - Laserfiche WebLink

Browse Search

6.13. - Page 10 of 42 thirty (30) days of employment; (2) thereafter, providing annual refresher training or reminders of the PH privacy and security safeguards to all Contractor's staff; (3) maintaining records indicating each Contractor's staff name and the date on which the privacy and security awareness training was completed; and (4) retaining training records for a period of three (3) years after completion of the training. d. Contractor agrees to provide documented sanction policies and procedures for Contractor's staff who fail to comply with privacy policies and procedures or any provisions of these requirements, including termination of employment when appropriate. e. Contractor agrees that all Contractor's staff performing services under this Agreement sign a confidentiality statement prior to accessing PH and annually thereafter. The signed statement shall be retained for a period of three (3) years, and the statement include at a minimum: (1) general use; (2) security and privacy safeguards; (3) unacceptable use; and (4) enforcement policies. Contractor agrees to conduct a background check of Contractor's staff before they may access PII with more thorough screening done for those employees who are authorized to bypass significant technical and operational security controls. Contractor further agrees that screening documentation shall be retained for a period of three (3) years following conclusion of the employment relationship. g. Contractor agrees to conduct periodic privacy and security reviews of work activity, including random sampling of work product by Contractor's staff by management level personnel who are knowledgeable and experienced in the areas of privacy and information security in the administration of County's programs and the use and disclosure of PII. Examples include, but are not limited to, access to data, case files or other activities related to the handling of PII. h. Contractor shall ensure that PH is used and stored in an area that is physically safe from access by unauthorized persons at all times and safeguard PH from loss, theft, or inadvertent disclosure by securing all areas of its facilities where Contractor's staff assist in the administration of the County's programs and use, disclose, or store PII. i. Contractor shall ensure that each physical location, where PH is used, disclosed, or stored, has procedures and controls that ensure an individual who is terminated from access to the facility is promptly escorted from the facility by an authorized employee of Contractor and access is revoked. Template Version Date —August 26, 2016 Page 7