04.Attachment_D_-_IT_Terms.docx

ATTACHMENT D

STATE OF OKLAHOMA INFORMATION TECHNOLOGY TERMS

The parties further agree to the following terms (“Information Technology Terms”), as applicable, for any acquisition of products or services with an information technology or telecommunication component. Pursuant to the Oklahoma Information Technology Consolidation and Coordination Act (“the act” or “act”), OMES Information Services (“OMES IS”) is designated to purchase information technology and telecommunication products and services on behalf of the state. The act directs OMES IS to acquire necessary hardware, software and services and to authorize the use by other State agencies. OMES, as the owner of information technology and telecommunication assets and contracts on behalf of the state, allows other state agencies to use the assets while retaining ownership and the right to reassign the assets, at no additional cost, upon written notification to supplier. Although OMES IS is the data custodian for state agency data, such data is owned by the respective state agency.

Definitions

1.1 Customer data means all data supplied by or on behalf of a customer in connection with the Contract, excluding any confidential information of supplier. Customer data includes both nonpublic data and personal data.

1.2 Data breach means unauthorized access or the reasonable suspicion of unauthorized access, by an unauthorized person that results in the use, destruction, loss, alteration, disclosure or theft of customer data.

1.3 Host includes the terms Hosted or Hosting and means the accessing, processing or storing of customer data.

1.4 Intellectual property rights means the worldwide legal rights or interests evidenced by or embodied in any idea, design, concept, personality right, method, process, technique, apparatus, invention, discovery or improvement including any patents, trade secrets and know-how; any work of authorship including any copyrights, moral rights or neighboring rights; any trademark, service mark, trade dress, trade name or other indicia of source or origin; domain name registrations; and any other proprietary or similar rights. Intellectual property rights of a party also includes all worldwide legal rights or interests that the party may have acquired by assignment or license with the right to grant sublicenses.

1.5 Nonpublic data means customer data, other than personal data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by customer because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information. Nonpublic data includes any data deemed confidential pursuant to the contract, otherwise identified by customer as nonpublic data, or that a reasonable person would deem confidential.

1.6 Personal data means customer data that contains 1) any combination of an individual’s name, Social Security number, driver’s license number, state/federal identification number, account number, credit or debit card number and/or 2) data subject to protection under federal, state or local law, rule, regulation or ordinance.

1.7 Security Incident means attempted or successful unauthorized access, use, disclosure, modification, loss, theft or destruction of information or interference with the hosted environment used to perform the services.

1.8 Supplier means the bidder with whom the state enters into the contract awarded pursuant to the solicitation or the business entity or individual that is a party to the contract with the state. A supplier with whom the state enters into an awarded contract shall also be known as a contractor.

1.9 Supplier intellectual property means all tangible or intangible items or things, including the intellectual property rights therein, created or developed by supplier and identified in writing as such (a) prior to providing any services or work product to customer and prior to receiving any documents, materials, information or funding from or on behalf of a customer relating to the services or work product, or (b) after the effective date of the contract if such tangible or intangible items or things were independently developed by supplier outside supplier’s provision of services or work product for customer under the contract and were not created, prepared, developed, invented or conceived by any customer personnel who then became personnel to supplier or any of its affiliates or subcontractors, where, although creation or reduction to-practice is completed while the person is affiliated with supplier or its personnel, any portion of same was created, invented or conceived by such person while affiliated with customer.

1.10 Third-Party Intellectual Property means the intellectual property rights of any third party that is not a party to the contract and not directly or indirectly providing any goods or services to a customer under the contract.

Termination of Maintenance and Support Services

1.11 Customer may terminate maintenance or support services without an adjustment charge, provided either of the following circumstances occur:

2.1.1 Customer removes the product for which the services are provided, from productive use.

2.1.2 The location at which the services are provided is no longer controlled by customer (for example, because of statutory or regulatory changes or the sale or closing of a facility).

1.12 If customer chooses to renew maintenance or support after maintenance has lapsed, customer may choose to pay the additional fee, if any, associated with renewing a license after such maintenance or support has lapsed, or to purchase a new license. Any amount paid to supplier in the form of prepaid fees that are unused when services under the contract or purchase order are terminated shall be refunded to customer.

Compliance and Electronic and Information Technology Accessibility

1.13 State procurement of information technology is subject to certain federal and State laws, rules and regulations related to information technology accessibility, including but not limited to Oklahoma’s information technology accessibility standards (“standards”) set forth at Accessibility of Information and Communication Technology Standard. Supplier shall provide a Voluntary Product Accessibility Template (VPAT) describing accessibility compliance via a weblink to the VPAT and shall update the VPAT as necessary to allow a customer to obtain current VPAT information as required by state law. If products require development or customization, additional requirements and documentation may be required, and compliance shall be necessary by supplier. Such requirements may be stated in appropriate documents including but not limited to a statement of work, riders, agreement, purchase order or addendum.

1.14 All representations contained in the VPAT provided will be relied upon by the state or a customer, as applicable, for accessibility compliance purposes.

Media ownership (disk drive and/or memory chip ownership)

1.15 Any disk drives and memory cards purchased with or included for use in leased or purchased products under the contract remain the sole and exclusive property of the customer.

1.16 Personal information may be retained within electronic media devices and components; therefore, electronic media shall not be released either between customers or for the resale, of refurbished equipment that has been in use by a customer, by the supplier to the general public or other entities. This provision applies to replacement devices and components, whether purchased or leased, supplied by supplier, its agents or subcontractors during the downtime (repair) of products purchased or leased through the contract. If a device is removed from a location for repairs, the customer shall have sole discretion, prior to removal, to determine and implement sufficient safeguards (such as a record of hard drive serial numbers) to protect personal information that may be stored within the hard drive or memory of the device.

Offshore Services

5.1 No offshore services are provided for under the contract. State data shall not be used or accessed internationally for troubleshooting or any other use not specifically provided for herein without the prior written permission, which may be withheld in the state’s sole discretion, from the appropriate authorized representative of the state. Notwithstanding the above, administrative back office functions of the supplier may be located offshore and the follow-the-sun support model may be used by the supplier to the extent allowed by law applicable to any customer data being accessed or used.

Compliance With Technology Policies

1.17 The supplier agrees to adhere to the State of Oklahoma Information Security Policy, Procedures and Guidelines.

Emerging Technologies

1.18 The state reserves the right to enter into an addendum to the contract at any time to allow for emerging technologies not identified elsewhere in the contract documents if there are repeated requests for such emerging technology or the state determines it is warranted to add such technology.

Extension Right

1.19 In addition to extension rights of the state set forth in the contract, the state chief information officer (CIO) reserves the right to extend any contract at his or her sole option if the state CIO determines such extension to be in the best interest of the state.

Source Code Escrow

1.20 Pursuant to 62 O.S. § 34.31, if customized computer software is developed or modified exclusively for a state agency, the supplier has a continuing obligation to comply with such law and place the source code for such software and any modifications thereto into escrow with an independent third-party escrow agent. Supplier shall pay all fees charged by the escrow agent and enter into an escrow agreement, the terms of which are subject to the prior written approval of the State, including terms that provide the state receives ownership of all escrowed source code upon the occurrence of any of the following:

9.1.1 A bona fide material default of the obligations of the supplier under the agreement with the applicable customer.

9.1.2 An assignment by the supplier for the benefit of its creditors.

9.1.3 A failure by the supplier to pay, or an admission by the supplier of its inability to pay, its debts as they mature.

9.1.4 The filing of a petition in bankruptcy by or against the supplier when such petition is not dismissed within 60 days of the filing date.

9.1.5 The appointment of a receiver, liquidator or trustee appointed for any substantial part of the supplier’s property.

9.1.6 The inability or unwillingness of the supplier to provide the maintenance and support services in accordance with the agreement with the agency.

9.1.7 Supplier’s ceasing of maintenance and support of the software.

9.1.8 Such other condition as may be statutorily imposed by the future amendment or enactment of applicable Oklahoma law.

Commercial Off-The-Shelf Software or Supplier Terms

1.21 If supplier specifies terms and conditions or clauses in an electronic license, subscription, maintenance, support or similar agreement, including via hyperlink or uniform resource locator (URL) address to an internet site, that conflict with the terms of this contract, the additional terms and conditions or conflicting clauses shall not be binding on the state, and the provisions of this contract shall prevail. Further, no such terms and conditions or clauses shall expand the state’s or customer’s liability or reduce the rights of customer or the state.

Ownership Rights

1.22 Any software developed, modified, or customized by the supplier in accordance with a mutually negotiated statement of work pursuant to this contract is for the sole and exclusive use of the state including but not limited to the right to use, reproduce, reuse, alter, modify, edit or change the software as it sees fit and for any purpose. The parties mutually agree that the state as a licensee of the supplier does not make a claim of ownership to the existing intellectual property of supplier. moreover, except with regard to any deliverable based on supplier intellectual property, the state shall be deemed the sole and exclusive owner of all right, title and interest therein, including but not limited to all source data, information and materials furnished to the state, together with all plans, system analysis, and design specifications and drawings, completed programs and documentation thereof, reports and listing, all data and test procedures and all other items pertaining to the work and services to be performed pursuant to this contract including all copyright and proprietary rights relating thereto. With respect to supplier intellectual property, the supplier grants the state, for no additional consideration, a perpetual, irrevocable, royalty-free license solely for the internal business use of the state to use, copy, modify, display, perform, transmit and prepare derivative works of supplier intellectual property embodied in or delivered to the state in conjunction with the products.

1.23 Except for any supplier intellectual property, all work performed by the supplier of developing, modifying or customizing software and any related supporting documentation shall be considered as work for hire (as defined under the U.S. copyright laws) and, as such, shall be owned by and for the benefit of state.

1.24 In the event that it should be determined that any portion of such software or related supporting documentation does not qualify as work for hire, supplier hereby irrevocably grants to the state, for no additional consideration, a non-exclusive, irrevocable, royalty-free license to use, copy, modify, display, perform, transmit and prepare derivative works of any such software and any supplier intellectual property embodied in or delivered to the state in conjunction with the products.

1.25 Supplier shall assist the state and its agents, upon request, in preparing U.S. and foreign copyright, trademark and/or patent applications covering software developed, modified or customized for the state when made in accordance with a mutually negotiated statement of work pursuant to this contract. Supplier shall sign any such applications upon request and deliver them to the state. The state shall bear all expenses incurred in connection with such copyright, trademark and/or patent applications.

Intellectual Property Ownership to Work Product The following terms apply to ownership and rights related to intellectual property:

1.26 As to the intellectual property rights to work product between supplier and customer, customer shall be the exclusive owner and not supplier. supplier specifically agrees that the work product shall be considered “works made for hire” and that the work product shall, upon creation, be owned exclusively by customer. To the extent that the work product, under applicable law, may not be considered works made for hire, supplier agrees that all right, title and interest in and to all ownership rights and all intellectual property rights in the work product is effectively transferred, granted, conveyed, assigned and relinquished exclusively to customer, without the necessity of any further consideration, and customer shall be entitled to obtain and hold in its own name all intellectual property rights in and to the work product. Supplier acknowledges that supplier and customer do not intend supplier to be a joint author of the work product within the meaning of the Copyright Act of 1976. Customer shall have access during normal business hours (Monday through Friday, 8 a.m. to 5 p.m.) and upon reasonable prior notice to supplier to all supplier materials, premises and computer files containing the work product. Supplier and customer, as appropriate, will cooperate with one another and execute such other documents as may be reasonably appropriate to achieve the objectives herein. No license or other right is granted under the contract to any third-party intellectual property, except as may be incorporated in the work product by supplier.

1.27 Supplier, upon request and without further consideration, shall perform any acts that may be deemed reasonably necessary or desirable by customer to evidence more fully the transfer of ownership and/or registration of all intellectual property rights in all work product to customer to the fullest extent possible including but not limited to the execution, acknowledgement and delivery of such further documents in a form determined by customer. In the event customer is unable to obtain supplier’s signature due to the dissolution of supplier or supplier’s failure to respond to customer’s repeated requests for such signature on any document reasonably necessary for any purpose set forth in the foregoing sentence, supplier hereby irrevocably designates and appoints customer and its duly authorized officers and agents as supplier’s agent and supplier’s attorney-in-fact to act for and in supplier’s behalf and stead to execute and file any such document and to do all other lawfully permitted acts to further any such purpose with the same force and effect as if executed and delivered by supplier, provided however that no such grant of right to customer is applicable if supplier fails to execute any document due to a good faith dispute by supplier with respect to such document. It is understood that such power is coupled with an interest and is therefore irrevocable. Customer shall have the full and sole power to prosecute such applications and to take all other action concerning the work product, and supplier shall cooperate, at customer’s sole expense, in the preparation and prosecution of all such applications and in any legal actions and proceedings concerning the work product.

1.28 Supplier hereby irrevocably and forever waives, and agrees never to assert, any moral rights in or to the work product which supplier may now have or which may accrue to supplier’s benefit under U.S. or foreign copyright or other laws and any and all other residual rights and benefits which arise under any other applicable law now in force or hereafter enacted. Supplier acknowledges the receipt of equitable compensation for its assignment and waiver of such moral rights.

1.29 All documents, information and materials forwarded to supplier by customer for use in and preparation of the work product shall be deemed the confidential information of customer, subject to the license granted by customer to supplier hereunder. Supplier shall not otherwise use, disclose or permit any third party to use or obtain the work product, or any portion thereof, in any manner without the prior written approval of customer.

1.30 These provisions are intended to protect customer’s proprietary rights pertaining to the work product and the intellectual property rights therein and any misuse of such rights would cause substantial and irreparable harm to customer’s business. Therefore, supplier acknowledges and stipulates that a court of competent jurisdiction may immediately enjoin a material breach of the supplier’s obligations with respect to confidentiality provisions of the contract and the work product and a customer’s intellectual property rights, upon a request by customer, without requiring proof of irreparable injury, as same is presumed.

1.31 Upon the request of customer, but in any event upon termination or expiration of this contract or a statement of work, supplier shall surrender to customer all documents and things pertaining to the work product, generated or developed by supplier or furnished by customer to supplier, including all materials embodying the work product, any customer confidential information and intellectual property rights in such work product, regardless of whether complete or incomplete. This section is intended to apply to all work product as well as to all documents and things furnished to supplier by customer or by anyone else that pertains to the work product.

1.32 Customer hereby grants to supplier a non-transferable, non-exclusive, royalty-free, fully paid license to use any work product solely as necessary to provide services to customer. Except as provided in this section, neither supplier nor any subcontractor shall have the right to use the work product in connection with the provision of services to its other customers without the prior written consent of customer, which consent may be withheld in customer’s sole discretion.

1.33 To the extent that any third party intellectual property is embodied or reflected in the work product or is necessary to provide services, supplier shall obtain from the applicable third party for the customer’s benefit, an irrevocable, perpetual, nonexclusive, worldwide, royalty-free license, solely for customer’s internal business purposes; likewise, with respect to any supplier intellectual property embodied or reflected in the work product or necessary to provide services, supplier grants to customer an irrevocable, perpetual, nonexclusive, worldwide, royalty-free license, solely for the customer’s internal business purposes. Each such license shall allow the applicable customer to (i) use, copy, modify, display, perform (by any means), transmit and prepare derivative works of any third-party intellectual property or supplier intellectual property embodied in or delivered to customer in conjunction with the work product and (ii) authorize others to do any or all of the foregoing. Supplier agrees to notify customer on delivery of the work product or services if such materials include any third-party intellectual property. The foregoing license includes the right to sublicense third parties, solely for the purpose of engaging such third parties to assist or carry out customer’s internal business use of the work product. Except for the preceding license, all rights in supplier intellectual property remain in supplier. On request, supplier shall provide customer with documentation indicating a third party’s written approval for supplier to use any third-party intellectual property that may be embodied or reflected in the work product.

1.34 Supplier agrees that it shall have written agreement(s) that are consistent with the provisions hereof related to work product and intellectual property rights with any employees, agents, consultants, contractors or subcontractors providing services or work product pursuant to the contract, prior to the provision of such services or work product and that it shall maintain such written agreements at all times during performance of this contract which are sufficient to support all performance and grants of rights by supplier. Copies of such agreements shall be provided to the customer promptly upon request.

1.35 To the extent not inconsistent with customer’s rights in the work product or other provisions, nothing in this contract shall preclude supplier from developing for itself, or for others, materials which are competitive with those produced as a result of the services provided under the contract, provided that no work product is utilized, and no intellectual property rights of customer therein are infringed by such competitive materials. To the extent that supplier wishes to use the work product or acquire licensed rights in certain intellectual property rights of customer therein to offer competitive goods or services to third parties, supplier and customer agree to negotiate in good faith regarding an appropriate license and royalty agreement to allow for such.

1.36 If any acquisition pursuant to the contract is funded wholly or in part with federal funds, the source code and all associated software and related documentation and materials owned by a customer may be shared with other publicly funded agencies at the discretion of such customer without permission from or additional compensation to the supplier.

Hosting Services

1.37 A supplier shall be responsible for the obligations set forth in in this contract, including those obligations related to breach reporting and associated costs when a supplier hosting customer data or providing products or services pursuant to an acquisition, contributes to, or directly causes a data breach or a security incident. Likewise, supplier shall be responsible for the obligations set forth in in this contract, including those obligations related to breach reporting and associated costs when a supplier’s affiliate or subcontractor contributes to or directly causes a data breach or security incident.

Change Management

1.38 When a scheduled change is made to products or services provided to a customer that impacts the customer’s system related to such product or service, supplier shall provide two weeks’ prior written notice of such change. When it is an emergency change, supplier shall provide 24 hours’ prior written notice of the change. Repeated failure to provide such notice may be an evaluation factor (as indicative of supplier’s past performance) upon renewal or if future bids submitted by supplier are evaluated by the state.

Service Level Deficiency

1.39 In addition to other terms of the contract, in instances of the supplier’s repeated failure to provide an acceptable level of service or meet service level agreement metrics, service credits shall be provided by supplier and may be used as an offset to payment due.

Ownership of IT and Telecommunication Assets

1.40 Notwithstanding any other provision in the contract and pursuant to the Oklahoma Information Technology Consolidation and Coordination Act, all information technology and telecommunication assets and contracts on behalf of appropriated agencies of the state belong to OMES IS. OMES IS allows other state agencies to use the assets while retaining ownership and the right to reassign the assets, at no additional cost, upon written notification to supplier.

Customer Data

1.41 The parties agree to the following provisions in connection with any customer data accessed, processed, transmitted or stored by or on behalf of the supplier, and the obligations, representations and warranties set forth below shall continue as long as the supplier has an obligation under the contract.

1.42 Customer will be responsible for the accuracy and completeness of all customer data provided to supplier by customer. Customer shall retain exclusive ownership of rights, title and interest in customer data. Nonpublic data and personal data shall be deemed to be customer’s confidential information. Supplier shall restrict access to customer data to their employees with a need to know (and advise such employees of the confidentiality and nondisclosure obligations assumed herein).

1.43 Supplier shall promptly notify the customer upon receipt of any requests from unauthorized third parties which in any way might reasonably require access to customer data or customer’s use of the hosted environment. Supplier shall notify the customer by the fastest means available and also in writing pursuant to contract notice provisions and the notice provision herein. Except to the extent required by law, supplier shall not respond to subpoenas, service or process, freedom of information act or other open records requests, and other legal request related to customer without first notifying the customer and obtaining the customer’s prior approval, which shall not be unreasonably withheld, of supplier’s proposed responses. Supplier agrees to provide its completed responses to the customer with adequate time for customer review, revision and approval.

1.44 Supplier will use commercially reasonable efforts to prevent the loss of or damage to customer data in its possession and will maintain commercially reasonable back-up procedures and copies to facilitate the reconstruction of any customer data that may be lost or damaged by supplier. Supplier will promptly notify customer of any loss, damage to or unauthorized access of customer data. Supplier will use commercially reasonable efforts to reconstruct any customer data that has been lost or damaged by supplier as a result of its negligence or willful misconduct. If customer data is lost or damaged for reasons other than as a result of supplier’s negligence or willful misconduct, supplier will, at the customer’s expense and the request of the state, use commercially reasonable efforts to reconstruct any customer data lost or damaged.

Data Security

1.45 Supplier will use commercially reasonable efforts, consistent with industry standards, to provide security for the hosted environment and customer data and to protect against both unauthorized access to the hosting environment, and unauthorized communications between the hosting environment and the customer’s browser. Supplier shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of personal data and nonpublic data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the service provider applies to its own personal data and nonpublic data of similar kind.

1.46 All personal data and nonpublic data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the service provider is responsible for encryption of personal data. All personal data and nonpublic data shall be subject to controlled access. Any stipulation of responsibilities shall be included in a statement of work and will identify specific roles and responsibilities.

1.47 Supplier represents and warrants the customer that the hosting equipment and environment will be routinely checked with a commercially available, industry-standard software application with up-to-date virus definitions. Supplier will regularly update the virus definitions to ensure that the definitions are as up to date as is commercially reasonable. Supplier will promptly purge all viruses discovered during virus checks. If there is a reasonable basis to believe that a virus may have been transmitted to customer by supplier, supplier will promptly notify customer of such possibility in a writing that states the nature of the virus, the date on which transmission may have occurred, and the means supplier has used to remediate the virus. Should the virus propagate to customer’s IT infrastructure, supplier is responsible for costs incurred by customer for customer to remediate the virus.

1.48 At no time shall any customer data or processes – that either belong to or are intended for the use of the state - be copied, disclosed or retained by supplier or any party related to supplier for subsequent use in any transaction that does not include the state unless otherwise agreed to by the state.

1.49 Supplier shall provide its services to customer and its users solely from data centers in the U.S. Storage of customer data at rest shall be located solely in data centers in the U.S. Supplier shall not allow its personnel or contractors to store customer data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Supplier shall permit its personnel and contractors to access customer data remotely only as required to fulfill supplier’s obligations under the contract.

1.50 Supplier shall allow the customer to audit conformance to the contract terms. The customer may perform this audit or contract with a third party at its discretion and at customer’s expense.

Security Assessment

1.51 The state requires any entity or third-party supplier hosting Oklahoma customer data to submit to a state certification and accreditation review process to assess initial security risk. Supplier submitted to the review and met the state’s minimum-security standards at time the contract was executed. Failure to maintain the state’s minimum-security standards during the term of the contract, including renewals, constitutes a material breach. Upon request, the supplier shall provide updated data security information in connection with a potential renewal. If information provided in the security risk assessment changes, supplier shall promptly notify the state and include in such notification the updated information; provided, however, supplier shall make no change that results in lessened data protection or increased data security risk. Failure to provide the notice required by this section or maintain the level of security required in the contract constitutes a material breach by supplier and may result in a whole or partial termination of the contract.

1.52 Any hosting entity change must be approved in writing prior to such change. To the extent supplier requests a different subcontractor than the third-party hosting supplier already approved by the state, the different subcontractor is subject to the state’s approval. Supplier agrees not to migrate state’s data or otherwise utilize the different third-party hosting supplier in connection with key business functions that are supplier’s obligations under the contract until the state approves the third-party hosting supplier’s state certification and accreditation review, which approval shall not be unreasonably withheld or delayed. in the event the third-party hosting supplier does not meet the state’s requirements under the state certification and accreditation review, supplier acknowledges and agrees it will not utilize the third-party supplier in connection with key business functions that are supplier’s obligations under the contract, until such third party meets such requirements.

Security Incident or Data Breach Notification

1.53 Supplier shall inform customer of any security incident or data breach.

1.54 Supplier may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. If a security incident involves customer data, supplier will coordinate with customer prior to any such communication.

1.55 Supplier shall report a security incident to the customer identified contact set forth herein within five days of discovery of the security incident or within a shorter notice period required by applicable law or regulation (i.e., HIPAA requires notice to be provided within 24 hours).

1.56 Supplier shall maintain processes and procedures to identify, respond to and analyze security incidents; (ii) make summary information regarding such procedures available to customer at customer’s request, (iii) mitigate, to the extent practicable, harmful effects of security incidents that are known to supplier; and (iv) documents all security incidents and their outcomes.

1.57 If supplier has reasonable belief or actual knowledge of a data breach, supplier shall (1) promptly notify the appropriate customer identified contact set forth herein within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner.

Data Breach Notification and Responsibilities This section only applies when a data breach occurs with respect to personal data or nonpublic data within the possession or control of supplier.

1.58 Only supplier shall (1) cooperate with customer as reasonably requested by customer to investigate and resolve the data breach; (2) promptly implement necessary remedial measures, if necessary; and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

1.59 Unless otherwise stipulated, if a data breach is a direct result of supplier’s breach of its obligation to encrypt personal data and non-public data or otherwise prevent its release, supplier shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by state law; (3) credit monitoring services required by state or federal law; (4) a website or toll-free numbers and call center for affected individuals required by state law – all not to exceed the agency per record per person cost calculated for data breaches in the united states on the most recent cost of data breach study: global analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by supplier based on root cause.

1.60 If a data breach is a direct result of supplier’s breach of its obligations to encrypt personal data and non-public data or otherwise prevent its release, supplier shall indemnify and hold harmless the customer against all penalties assessed to indemnified parties by governmental authorities in connection with the data breach.

Supplier Representations and Warranties Supplier represent and warrants the following:

1.61 The product and services provided in connection with hosting services do not infringe a third party’s patent or copyright or other intellectual property rights.

1.62 Supplier will protect customer’s nonpublic data and personal data from unauthorized dissemination and use with the same degree of care that each such party uses to protect its own confidential information and, in any event, will use no less than a reasonable degree of care in protecting such confidential information.

1.63 The execution, delivery and performance of the contract and any ancillary documents and the consummation of the transactions contemplated by the contract or any ancillary documents by supplier will not violate, conflict with or result in a breach of any provision of, or constitute a default (or an event which, with notice or lapse of time or both, would constitute a default) under or result in the termination of any written contract or other instrument between supplier and any third parties retained or utilized by supplier to provide goods or services for the benefit of the customer.

1.64 Supplier shall not knowingly upload, store, post, email or otherwise transmit, distribute, publish or disseminate to or though the hosting environment any material that contains software viruses, malware or other surreptitious code designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment or circumvent any “copy-protected” devices, or any other harmful or disruptive program.

Indemnity

1.65 Supplier agrees to defend, indemnify and hold the state, its officers, directors, employees, and agents harmless from all liabilities, claims, damages, losses, costs, expenses, demands, suits and actions (including without limitation reasonable attorneys’ fees and costs required to establish the right to indemnification), excluding damages that are the sole fault of customer, arising from or in connection with supplier’s breach of its express representations and warranties in these information technology terms and the contract. If a third party claims that any portion of the products or services provided by supplier under the terms of another contract document or these information technology terms infringes that party’s patent or copyright, supplier shall defend, indemnify and hold harmless the state and customer against the claim at supplier’s expense and pay all related costs, damages, and attorney’s fees incurred by or assessed to, the state and/or customer. The state and/or customer shall promptly notify supplier of any third-party claims and to the extent authorized by the attorney general of the state, allow supplier to control the defense and any related settlement negotiations. If the attorney general of the state does not authorize sole control of the defense and settlement negotiations to supplier, supplier shall be granted authorization to equally participate in any proceeding related to this section, but supplier shall remain responsible to indemnify customer and the state for all associated costs, damages and fees incurred by or assessed to the state and/or customer. Should the software become, or in supplier’s opinion, be likely to become the subject of a claim or an injunction preventing its use as contemplated in connection with hosting services, supplier may, at its option (i) procure for the state the right to continue using the software or (ii) replace or modify the software with a like or similar product so that it becomes noninfringing.

Termination, Expiration and Suspension of Service

1.66 During any period of service suspension, supplier shall not take any action to intentionally disclose, alter or erase any customer data.

1.67 In the event of termination or expiration of the contract, the parties further agree that the supplier shall implement an orderly return of customer data in a format specified by the customer and, as determined by the customer, one of the following:

24.2.1 Return the customer data to customer at no additional cost, at a time agreed to by the parties and the subsequent secure disposal of state data.

24.2.2 Transitioned to a different supplier at a mutually agreed cost and in accordance with a mutually agreed data transition plan and the subsequent secure disposal of state data.

24.2.3 A combination of the two immediately preceding options.

1.68 Supplier shall not take any action to intentionally erase any customer data for a period of:

24.3.1 10 days after the effective date of termination, if the termination is in accordance with the contract period.

24.3.2 30 days after the effective date of termination, if the termination is for convenience.

24.3.3 60 days after the effective date of termination if the termination is for cause.

After such period, supplier shall, unless legally prohibited or otherwise stipulated, delete all customer data in its systems or otherwise in its possession or under its control.

1.69 The state shall be entitled to any post termination or expiration assistance generally made available with respect to the services.

1.70 Disposal by supplier of customer data in all its forms, such as disk, CD/DVD, backup tape and paper, when requested by the customer, shall be performed in a secure manner. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to customer within 30 calendar day of its request for disposal of data.

General Information Security Requirements

1.71 No employee of contractor or its subcontractors will be granted access to State of Oklahoma agency information systems without the prior completion and approval of applicable login authorization and acceptable use requests.

1.72 Contractor or its subcontractors will notify applicable State of Oklahoma agencies when employees who have access to agency information systems are terminated.

1.73 Contractor or its subcontractors will disclose to client any suspected security breach of the information system or the data contained therein in the most expedient time possible and without unreasonable delay and will cooperate with client during the investigation of any such incident.

1.74 Contractor or its subcontractors agree to adhere to the State of Oklahoma Information Security Policy, Procedures and Guidelines.

HIPAA Requirements

1.75 Contractor shall agree to use and disclose protected health information (PHI) in its possession or control in compliance with the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) (45 CFR Parts 160 and 164) under the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The definitions set forth in the Privacy Rule are incorporated in this contract by reference (45 CFR §§ 160.103 and 164.501).

1.76 If applicable, contractor will sign and adhere to a business associate agreement (BAA). The BAA provides satisfactory assurances that contractor will use the information only for the purposes for which it was engaged. Contractor agrees it will safeguard the information from misuse and will comply with HIPAA as it pertains to the duties stated within the contract. Failure to comply with the requirements of this standard may result in funding being withheld from contractor, and/or full audit and inspection of contractor’s security compliance as it pertains to this contract.

1.77 Business associate terms and definitions:

26.3.1 Unless otherwise defined in this BAA, all terms used in this BAA have the meanings ascribed in the HIPAA regulations, provided; however, PHI and ePHI shall mean protected health information and electronic protected health information, respectively, as defined in 45 CFR § 160.103, limited to the information business associate received from or created or received on behalf of the applicable State of Oklahoma agency as a business associate.

26.3.2 “Administrative safeguards” shall have the same meaning as the term “administrative safeguards in 45 CFR § 164.304, with the exception that it shall apply to the management of the conduct of business associate’s workforce, not the State of Oklahoma agency workforce, in relation to the protection of that information.

26.3.3 “Business associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the entity whose name appears below.

26.3.4 “Covered entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103.

26.3.5 “HIPAA rules” shall mean the privacy, security, breach notification, and enforcement rules at 45 CFR Part 160 and Part 164, all as may be amended.

26.3.6 The following terms used in this agreement shall have the same meaning as those terms in the HIPAA rules: breach, data aggregation, designation record set, disclosure, health care operations, individual, minimum necessary, Notice of Privacy Practices, protected health information, required by law, secretary, security incident, subcontractor, unsecured PHI, and use.

1.78 Obligations of business associate: Business associate (BA) may use ePHI and PHI (collectively, “PHI”) solely to perform its duties and responsibilities under this agreement and only as provided in this agreement. BA acknowledges and agrees that PHI is confidential and shall not be used or disclosed, in whole or in part, except as provided in this agreement or as required by law. Specifically, BA agrees it will, as applicable:

26.4.1 Use or further disclose PHI only as permitted in this agreement or as required by law, including but not limited to the privacy and security rule.

26.4.2 Use appropriate safeguards and comply with 45 CFR Part 164 Subpart C with respect to ePHI to prevent use or disclosure of PHI other than as provided by this agreement.

26.4.3 Implement and document administrative safeguards to prevent, detect, contain and correct security violations in accordance with 45 CFR 164.

26.4.4 Make its applicable policies and procedures required by the security rule available to covered entity solely for purposes of verifying BA’s compliance and the secretary of the U.S. Department of Health and Human Services (HHS).

26.4.5 Not receive remuneration from a third party in exchange for disclosing PHI received from or on behalf of covered entity.

26.4.6 In accordance with 45 CFR 164.502(e)(1) and 164/308(b), if applicable, require that any subcontractors that create, receive, maintain or transmit PHI on behalf of the BA agree to the same restrictions, conditions and requirements that apply to the BA with respect to such information; this shall be in the form of a written HIPAA BA contract and a fully executed copy will be provided to the contract monitor.

26.4.7 Report to covered entity in writing any use or disclosure of PHI that is not permitted under this agreement as soon as reasonably practicable but in no event later than five calendar days from becoming aware of it and mitigate, to the extent practicable and in cooperation with covered entity, any harmful effects known to it of a use or disclosure made in violation of this agreement.

26.4.8 Promptly report to covered entity in writing and without unreasonable delay and in no case later than five calendar days any successful security incident, as defined in the security rule, with respect to ePHI.

26.4.9 Except for law enforcement delays that satisfy the requirements of 45 CFR 164.412, notify covered entity promptly in writing and without unreasonable delay and in no case later than five calendar days, upon the discovery of a breach of unsecured PHI. Such notice shall include, to the extent possible, the name of each individual whose unsecured PHI has been or is reasonably believed by BA to have been accessed, acquired or disclosed during such breach. BA shall also, to the extent possible, furnish covered entity with any other available information that covered entity is required to include in its notification to Individuals under 45 CFR § 164.404(c) at the time of BA’s notification to covered entity or promptly thereafter as such information becomes available. As used in this section, “breach” shall have the meaning given such term at 45 CFR 164.402.

26.4.10 To the extent allowed by law, indemnify and hold covered entity harmless from all claims, liabilities costs, and damages arising out of or in any manner related to the unauthorized disclosure by BA of any PHI resulting from the negligent acts or omissions of BA or to the breach by BA of any applicable obligation related to PHI.

26.4.11 Provide access to PHI it maintains in a designated record set to covered entity, or to an individual if directed by covered entity to meet the requirements of 45 CFR 164.524. If any individual requests access to PHI directly from BA, BA shall forward such request to covered entity within five working days of receiving a request.