17-RFP2009 - Part H - Exhibit J - COA - Confidentiality and Non-Disclosure Agreement - Final.pdf

CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT:

This CONFIDENTIALITY AGREEMENT (“Agreement”) is by and between ______________ (“Vendor”), a _____________ corporation and the City of Alexandria, a Virginia municipal corporation (“City”).

1. Definition of City Information: As used in this Agreement, "City Information" includes, but is not limited to, the information of the City, its employees, contractors, residents, clients, patients, taxpayers, and property as well as information that the City shares with Vendor for testing, support, conversion, or other services which may be accessed through other City owned or controlled databases.

2. Definition of Confidential Information: As used in this Agreement, “Confidential

Information” includes, but is not limited to, information that in any manner describes, locates or indexes anything about an individual including, but not limited to, his/her (hereinafter “his”) personal health information, treatment, disability, services eligibility, services provided, investigations, real or personal property holdings, and his education, financial transactions, financial account information, medical history, ancestry, religion, political ideology, criminal or employment record, social security number, tax status or payments, date of birth, address, phone number or that affords a basis of inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual, and the record of his presence, registration, or membership in an organization or activity, or admission to an institution.

3. Non-Disclosure and Nonuse Obligations: Vendor hereby agrees that the Vendor will hold City

Information and Confidential Information secure and protect it against loss, misuse, alteration, destruction, or disclosure. Vendor further agrees that it will maintain the privacy and security of City Information and Confidential Information and not divulge or allow or facilitate access to City Information or Confidential Information for any purpose or by anyone unless expressly authorized.

4. Inadvertence. Vendor further agrees that it will not directly or indirectly use or facilitate the use or dissemination of City Information or Confidential Information (whether intentionally or by inadvertence, negligence or omission verbally, electronically, through paper transmission or otherwise) for any purpose other than that directly associated with its work under the Contract.

Vendor acknowledges that any unauthorized use, dissemination or disclosure of information is prohibited and may also constitute a violation of Virginia and/or federal laws, subjecting it or its employees to civil and/or criminal penalties and/or subjecting it or its employees to other claims against it available under the law.

5. Coordination. Vendor shall coordinate closely with the City to ensure that its authorization to its employees or approved subcontractors is appropriate, tightly controlled and that such person(s) also maintain the security and privacy of City Information and Confidential Information.

6. Preserving Information. Vendor agrees to take strict security measures to ensure that City Information and Confidential Information is kept secure, properly stored, that if stored that it is encrypted as appropriate, stored in accordance with industry best practices and otherwise protected from retrieval or access by unauthorized persons or unauthorized purpose. Vendor further agrees that Vendor will ensure that any laptops, tablets, flash drive or other media storage devices, as approved by the City, and connected to the City network are secure and free of all computer viruses, or running the latest version of an industry standard virus protection program.

Vendor will ensure that all passwords used by its employees or subcontractors are robust, protected and not shared. No City Information may be downloaded except as agreed to by the parties and then only onto a City approved device. No City information may be downloaded to or stored on a non-City owned laptop, tablet, flash drives, or other device capable of storing data.

7. Disclosure. Vendor agrees that it will notify the City immediately upon discovery, becoming aware or suspicion of any unauthorized access to or disclosure of City Information or Confidential Information, also including any prohibited downloading or storage of City information, security breach as defined under Virginia law or any other applicable state security breach notification law, hacking or other breach of this Agreement, the Contract, City policy, Vendor’s security policies or any other breach of Contract protocols. The Vendor will cooperate fully with the City to regain possession of any Information and to prevent its further disclosure, use or dissemination. The Vendor also agrees, if requested, to promptly notify others, including but not limited to affected individuals and regulators, of a suspected or actual breach as required under this agreement or applicable state law and take actions necessary to protect individuals that may suffer injury as a result of breach under this agreement. The notice provided by the Vendor shall be approved by the City prior to any notification to others, including but not limited to individuals or regulators, regarding a suspected or actual breach.

8. Survival. This Agreement shall govern all communications between the parties. Vendor understands that its obligations shall survive the termination of any other relationship between the parties. Upon termination of any relationship between the parties, Vendor will promptly deliver to the City, without retaining any copies, all documents and other materials furnished to Vendor by City. If the destruction or return of Confidential Information is not feasible, the protections of this Agreement and obligations contained therein shall remain in effect.

9. Governing Law. This Agreement shall be governed in all respects by the laws of the United States of America and by the laws of the State of Virginia.

10. Injunctive Relief. A breach of any of the promises or agreements contained herein will result in irreparable and continuing damage to City for which there will be no adequate remedy at law, and City shall be entitled to injunctive relief and/or a decree for specific performance, and such other relief as may be proper (including monetary damages if appropriate).

11. Entire Agreement. This Agreement constitutes the entire agreement with respect to the Confidential Information disclosed herein and supersedes all prior or contemporaneous oral or written agreements concerning such Confidential Information. This Agreement may only be changed by mutual agreement of authorized representatives of the parties in writing.

Signed:

Name:

Title: ________________________

Date:

Attest: