Appendix A_020526.pdf

Information and Information Systems Security –

Contractor Non-Disclosure Agreement

Instructions: The Contractor and subcontractors shall submit this completed non-disclosure agreement for each employee having access to non-public government information under this contract. The non-disclosure agreements shall be submitted to the Contracting Officer prior to the performance of work.

Access to Department of Health and Human Services (HHS) information and HHS sensitive informationi is required in the performance of my official duties, under contract number

I agree that I shall:

(a) Comply with all HHS information security and privacy program policies, procedures, practices and related contract requirements, specifications, and clauses. This includes complying with HHS privacy and confidentiality laws and HHS implementing regulations, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-

191)(45 CFR sec. 160 and 164), the Privacy Act of 1974(5 U.S.C. 522a), the E-

Government Act of 2002, NIST SP 800-53, and Executive Order 13556, Controlled

Unclassified Information (implemented at 32 CFR, part 2002);

(b) Complete HHS Privacy and HHS security awareness training on an annual basis;

(c) Complete HIPAA Training, if provided access to protected health information, on an annual basis;

(d) Use information provided by HHS or collected by the contractor or its employees, subcontractors, or business associates on behalf of HHS only for the purpose of carrying out the provisions of the contract. I shall not disclose information or make known in any manner to any persons except as may be necessary in the performance of the contract.

(e) Protect the confidentiality, integrity, and availability of such information in accordance with HHS policies.

I understand that unauthorized disclosure of information will be subject to the HHS sanction policies and/or governed by the following laws and regulations:

(i) 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

(ii) 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

(iii) 44 U.S.C. chapter 35, subchapter I (Paperwork Reduction Act).

I affirm that I have received a written and/or verbal briefing by my company concerning my responsibilities under this agreement. I understand that violation of this agreement may subject me to criminal and civil penalties.

Signed:

Type or Print Name:

Date:

Witnessed by:

Date:

Copies are to be retained by: HHS Contracting Officer; HHS Contracting Officer’s

Representative; Contractor’s Contract Management; Individual Signatory i HHS sensitive information means all HHS data, on any storage media or in any form or format, which requires confidentiality, integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

(iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.