Agmt22 County of San Mateo - Laserfiche WebLink

Browse Search

Contract Template <,000 May 2021 Page 35 REV: 06-16-22 SK cabinets, locked file rooms, locked desks, or locked offices in facilities which are multi-use, meaning that there are Contractor’s staff and non-Contractor functions in one building in work areas that are not securely segregated from each other. It is recommended that all PII be locked up when unattended at any time, not just within multi-use facilities. jj. Contractor shall ensure that any PII that must be disposed of will be through confidential means, such as cross cut shredding or pulverizing. kk. Contractor agrees that PII must not be removed from its facilities except for identified routine business purposes or with express written permission of the County. ll. Contractor shall ensure that faxes containing PII shall not be left unattended and fax machines shall be in secure areas. Faxes containing PII shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them and notify the sender. All fax numbers shall be verified with the intended recipient before send the fax. mm.Contractor shall ensure that mailings containing PII shall be sealed and secured from damage or inappropriate viewing of PII to the extent possible. Mailings that include five hundred (500) or more individually identifiable records containing PII in a single package shall be sent using a tracked mailing method that includes verification of delivery. IV. Reporting of Breaches Required by Contractor to County; Mitigation a. Contractor shall report to County within one business day of discovery, to the County contact listed in this agreement by email or telephone as listed in the of unsecured PII, if that PII was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion or unauthorized access, use or disclosure of PII in violation of this Agreement, or potential loss of confidential data affecting this Agreement. b. Contractor understands that State and Federal Law requires a breaching entity to notify individuals of a breach or unauthorized disclosure of their PII. Contractor shall ensure that said notifications shall comply with the requirements set forth in California Civil Code section 1798.29, and 42 U.S.C. section 17932, and its implementing regulations, including but not limited to, the requirement that the notifications be made without unreasonable delay and in no event later than sixty (60) calendar days. c. Contractor agrees to promptly mitigate, to the extent practicable, any harmful effect that is known to Contractor stemming from a use or disclosure of PII in violation of the requirements of this Agreement, including taking any action pertaining to such use or disclosure required by applicable Federal and State laws and regulations. ATTY/AGR.2022.153/County of San Mateo (HSA Contract June 2022) (Page 35 of 37) DocuSign Envelope ID: F5FF63A3-8103-4442-8F5F-F37301405123