Agmt22 County of San Mateo - Laserfiche WebLink

Browse Search

Contract Template <,000 May 2021 Page 31 REV: 06-16-22 SK e. Contractor agrees that all Contractor’s staff performing services under this Agreement sign a confidentiality statement prior to accessing PII and annually thereafter. The signed statement shall be retained for a period of three (3) years, and the statement include at a minimum: (1) general use; (2) security and privacy safeguards; (3) unacceptable use; and (4) enforcement policies. f. Contractor agrees to conduct a background check of Contractor’s staff before they may access PII with more thorough screening done for those employees who are authorized to bypass significant technical and operational security controls. Contractor further agrees that screening documentation shall be retained for a period of three (3) years following conclusion of the employment relationship. g. Contractor agrees to conduct periodic privacy and security reviews of work activity, including random sampling of work product by Contractor’s staff by management level personnel who are knowledgeable and experienced in the areas of privacy and information security in the administration of County’s programs and the use and disclosure of PII. Examples include, but are not limited to, access to data, case files or other activities related to the handling of PII. h. Contractor shall ensure that PII is used and stored in an area that is physically safe from access by unauthorized persons at all times and safeguard PII from loss, theft, or inadvertent disclosure by securing all areas of its facilities where Contractor’s staff assist in the administration of the County’s programs and use, disclose, or store PII. i. Contractor shall ensure that each physical location, where PII is used, disclosed, or stored, has procedures and controls that ensure an individual who is terminated from access to the facility is promptly escorted from the facility by an authorized employee of Contractor and access is revoked. j. Contractor shall ensure that there are security guards or a monitored alarm system at all times at Contractor’s facilities and leased facilities where five hundred (500) or more individually identifiable records of PII is used, disclosed, or stored. Video surveillance systems are recommended. k. Contractor shall ensure that data centers with servers, data storage devices, and/or critical network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that limit access to only those authorized by this Agreement. Visitors to any Contractor data centers area storing PII as a result of administration of a County program must be escorted at all times by authorized Contractor’s staff. l. Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which Contractor staff can transport PII, as well as the physical security requirements during transport. ATTY/AGR.2022.153/County of San Mateo (HSA Contract June 2022) (Page 31 of 37) DocuSign Envelope ID: F5FF63A3-8103-4442-8F5F-F37301405123