Agda Pkt 2025.06.09 Joint SA PFA

Browse Search

Page 14 facilities which are multi--Contractor functions in one building in work areas that are not securely segregated from each other. It is recommended that all PII be locked up when unattended at any time, not just within multi-use facilities. jj. Contractor shall ensure that any PII that must be disposed of will be through confidential means, such as crosscut shredding or pulverizing. kk. Contractor agrees that PII must not be removed from its facilities except for identified routine business purposes or with express written permission of the County. ll. Contractor shall ensure that faxes containing PII shall not be left unattended and fax machines shall be in secure areas. Faxes containing PII shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them and notify the sender. All fax numbers shall be verified with the intended recipient before send the fax. mm. Contractor shall ensure that mailings containing PII shall be sealed and secured from damage or inappropriate viewing of PII to the extent possible. Mailings that include five hundred (500) or more individually identifiable records containing PII in a single package shall be sent using a tracked mailing method that includes verification of delivery. 20.4. Reporting of Breaches Required by Contractor to County; Mitigation a. Contractor shall report to County within one business day of discovery, to the County contact listed in this agreement by email or telephone as listed in the of unsecured PII, if that PII was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion or unauthorized access, use or disclosure of PII in violation of this Agreement, or potential loss of confidential data affecting this Agreement. b. Contractor understands that State and Federal Law requires a breaching entity to notify individuals of a breach or unauthorized disclosure of their PII. Contractor shall ensure that said notifications shall comply with the requirements set forth in California Civil Code section 1798.29, and 42 U.S.C. section 17932, and its implementing regulations, including but not limited to, the requirement that the notifications be made without unreasonable delay and in no event later than sixty (60) calendar days. c. Contractor agrees to promptly mitigate, to the extent practicable, any harmful effect that is known to Contractor stemming from a use or disclosure of PII in violation of the requirements of this Agreement, including taking any action pertaining to such use or disclosure required by applicable Federal and State laws and regulations. 20.5. Permitted Uses and Disclosures of PII by Contractor Except as otherwise limited in this schedule, Contractor may use or disclose PII to perform functions, activities, or services for, or on behalf of, County as specified in the Agreement; provided that such use or disclosure would not violate the Privacy Rule if done by County. 20.6. Obligations of County a. County shall provide Contractor with the notice of privacy practices that County produces in accordance with California Welfare and Institutions Code section 10850, as well as any changes to such notice. (500) or more individually identifiable records containing (500) or more individually identifiable records containing a single package shall be sent using a tracked mailing method using a tracked mailing method that that includes verificationincludes verification of delivery.of delivery. Reporting of Breaches Required by Contractor to County; MitigationReporting of Breaches Required by Contractor to County; Mitigation ATTY/AGR/2025.134/ CORE SERVICE AGENCY CONTRACT (SMC AND RWC) REV: 06-04-25 VR Page 14 of 48 6.L. - Page 17 of 51 114