3-Appriss_Exceptions_Tracker_(State_Edits_6.27)[1].xlsx

Tracker

to produce a full list of the system configurations that govern the System behavior at runtime and that implement the validated requirements. These configurations should be grouped by the user group that is intended to administer them, e.g. overall system configurations administered by the CVNS operator team, LEA configurations administered by each participating LEA, crime victim configurations administered by a proxy of crime victims, and so on. Alternate language: <STRIKE>

Rationale: Equifax cannot agree to an ever-changing definition that Equifax has no control over, however we can agree to the definition as of the Effective Date of the contract. State can accept as follows:

Data Breach is used herein as defined as stated in A.R.S. Title 18, chapter 5, article 4 (Data Security Breaches), or in any relevant state or federal standard, to indicate an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals. We are a national solution and processes can't be dictated by a single contributor. As such, Contractor cannot agree to an ever-changing definition that Contractor has no control over, however we can agree to the definition as of the Effective Date of the contract. Insights does not have the capability to monitor State's government definition changes, so we can agree to the definition as of today and adjust the contract through a modifciation if the State definition ever changes. The State should be able to track and be notified when State statutes are adjusted. Reviewing with Homeland State can accept as follows:

https://spo.az.gov/suppliers/usage-reporting.

https://spo.az.gov/suppliers/usage-reporting.

circumstances and Contractor duly gives its verbal acceptance, then Contractor will be deemed to have accepted the Order immediately upon commencing performance, provided that, Contractor must follow-up its verbal acceptance by accepting the Purchase Order electronically in the State’s eProcurement System within three (3) business days. Contractor shall thereafter be barred from subsequently rejecting the Order in the State’s eProcurement System and if it does so the rejection will be void

THE CONTRARY IN THIS CONTRACT, TO THE EXTENT PERMITTED BY LAW, THE AGGREGATE LIABILITY OF THE CONTRACTOR IN EACH CASE UNDER THIS CONTRACT (AND WHETHER SUCH LIABILITY ARISES FROM ANY CLAIM BASED ON INDEMNITY, BREACH OR CONFIDENTIALITY, WARRANTY, TORT (INCLUDING NEGLIGENCE OR BREACH OF STATUTORY DUTY), OR OTHERWISE) SHALL NOT EXCEED FIVE MILLION U.S. DOLLARS ($5,000,000).”

Rationale: Contractor should only be liable for what it causes. We further requests to narrow the scope to gross negligence and willful misconduct. Additionally, “omissions” is too broad. If there were an act to which claim would arise it would fall under gross negligence or willful misconduct. Under Risk Review RM: Reject. Contractor's requested changes will not be considered unless and until text proposed to be omitted is indicated clearly via strikethrough and text proposed to be added is indicated clearly via new color or underlining. Note: State will not accept gross negligence as a standard of care for triggering indemnification obligations. Contractor's indemnification obligations may not be subject to any damage limitations. RESPONSE: We can agree to the State's original language. This Exception Removed. Original Language Reinstated. RESOLVED. Negotiated language shall read as follows:

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees (hereinafter referred to as “Indemnitee”) from and against any and all third party claims, actions, liabilities, damages, losses, or expenses (including court costs, attorneys’ fees, and costs of claim processing, investigation and litigation) (hereinafter referred to as “Claims”) to the extent arising from any bodily injury or personal injury (including death), or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of its owners, officers, directors, agents, employees or Subcontractors. This indemnity includes any claim or amount arising out of, or recovered under, the Workers’ Compensation Law or arising out of the failure of such Contractor to conform to any applicable law, federal, state, or local law, statute, ordinance, rule, regulation, or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all claims. It is agreed that Contractor will be responsible for primary loss investigation, defense, and judgment costs where this indemnification is applicable. In consideration of the award of this contract, the Contractor agrees to waive all rights of subrogation against the State of Arizona, its officers, officials, agents, and employees for losses arising from the work performed by the Contractor for the State of Arizona. This indemnity shall not apply if the Contractor or Subcontractor(s) is/are an agency, board, commission or university of the State of Arizona.

6.3 Patent & Copyright Indemnification Patent and Copyright Indemnification. [CONTRACTOR/VENDOR (NOT PUBLIC AGENCY)]. With respect to Materials or Services provided or proposed by a Contractor Indemnitor for performance under the Contract, Contractor shall indemnify, defend and hold harmless State Indemnitees against any third-party claims for liability, costs, and expenses, including, but not limited to reasonable attorneys' fees, for infringement or violation of any patent, trademark, copyright, or trade secret by the Materials and the Services. With respect to the defense and payment of claims under this subparagraph:

6.3.1. State shall provide reasonable and timely notification to Contractor of any claim for which Contractor may be liable under this paragraph;

6.3.2. Contractor, with reasonable consultation from State, shall have control of the defense of any action on an indemnified claim including all negotiations for its settlement or compromise;

6.3.3. State may elect to participate in such action at its own expense; and

6.3.4. State may approve or disapprove any settlement or compromise, provided that, (i) State shall not unreasonably withhold or delay such approval or disapproval and (ii) State shall cooperate in the defense and in any related settlement negotiations.

If Contractor is a public agency, this section 6.3 does not apply. Patent and Copyright Indemnification. [CONTRACTOR/VENDOR (NOT PUBLIC AGENCY)]. With respect to Materials or Services provided or proposed by a Contractor Indemnitor for performance under the Contract, Contractor shall indemnify, defend and hold harmless State Indemnitees against any third-party claims for liability, costs, and expenses, including, but not limited to reasonable attorneys' fees, for infringement or violation of any patent, trademark, copyright, or trade secret by the Materials and the Services. With respect to the defense and payment of claims under this subparagraph:

6.3.1. State shall provide reasonable and timely notification, however no later than ten (10) business days, to Contractor of any claim for which Contractor may be liable under this paragraph;

6.3.2. Contractor, with reasonable consultation from State, shall have control of the defense of any action on an indemnified claim including all negotiations for its settlement or compromise;

6.3.3. State may elect to participate in such action at its own expense; and

6.3.4. State may approve or disapprove any settlement or compromise, provided that, (i) State shall not unreasonably withhold or delay such approval or disapproval and (ii) State shall cooperate in the defense and in any related settlement negotiations.

If Contractor is a public agency, this section 6.3 does not apply. Under Risk Review State can accept language in C37 with one exception. State needs a minimum of 20 business days to notify Contractor of a claim.

Response: Okay Patent and Copyright Indemnification. [CONTRACTOR/VENDOR (NOT PUBLIC AGENCY)]. With respect to Materials or Services provided or proposed by a Contractor Indemnitor for performance under the Contract, Contractor shall indemnify, defend and hold harmless State Indemnitees against any third-party claims for liability, costs, and expenses, including, but not limited to reasonable attorneys' fees, for infringement or violation of any patent, trademark, copyright, or trade secret by the Materials and the Services. With respect to the defense and payment of claims under this subparagraph:

6.3.1. State shall provide reasonable and timely notification, however no later than twenty (20) business days, to Contractor of any claim for which Contractor may be liable under this paragraph;

6.3.2. Contractor, with reasonable consultation from State, shall have control of the defense of any action on an indemnified claim including all negotiations for its settlement or compromise;

6.3.3. State may elect to participate in such action at its own expense; and

6.3.4. State may approve or disapprove any settlement or compromise, provided that, (i) State shall not unreasonably withhold or delay such approval or disapproval and (ii) State shall cooperate in the defense and in any related settlement negotiations.

Rationale: 48 hours is the "latest" process time to client notification of a confirmed incident, which also aligns with the time to triage, contain and eradicate on the way to recover, and mandated reporting to the Equifax Board of Directors. Of course, we will notify sooner as able. Under Homeland Review 24 hours is a hard requirement. Language modifying to "within 24 hours of discovery" is acceptable. We need sufficient time to investigate a potential incident. 48 hours is the "latest" process time to client notification of a confirmed incident, which also aligns with mandated reporting to the Equifax Board of Directors. Of course we will notify sooner as able. A breach process is a busy time as we identify the threat, triage it, contain it, then eradicate it on the way to recovery. Reporting is important and no-later-than 48 hours is the standard to align with process.

Modification of applicable incidents is not acceptable. Acceptable language: "notify State within 48 hours of discovery of unauthorized access or inappropriate disclosures that affect State data, whether stemming from an external data breach, internal data breach, system failure, or procedural lapse."

No issue with inclusion of "reasonably".

Full removal of (c) not acceptable. Acceptable modification: "...unauthorized access or inapropriate disclosure of State data; and..." Language modifying to "within 24 hours of confirmation" is within our processes. We need sufficient time to investigate a potential incident. This provides process time to client notification of a confirmed incident, which also aligns with mandated reporting to the Equifax Board of Directors. Of course we will notify sooner as able. A breach process is a busy time as we identify the threat, triage it, contain it, then eradicate it on the way to recovery. Reporting is important and no-later-than 48 hours is the standard to align with process.

Rationale: Unless required by applicable law or government enforcement or regulatory agency having jurisdiction, EWS shall not identify by name or implication in any announcements about Incidents without prior consent of Client. Under Homeland Review (b) shall not be removed. Acceptable modification: "...to State's designated representative, unless otherwise required by law." We understand day to day needs / info requests come up and want to support. Day to day the account team will field the calls and submit a ticket for tracking the task and expediting resolution. Otherwise, I need some clarification on the need as stated in AZ law. Also, others will get data, but that data is in accordance with the contract. The item struck sounds like routine operations, and we do not divulge data except for a permissible purpose.

(b) Contractor will comply with the Law, regulations, Law Enforcement and in accordance with the contract, when responding to any requests it receives from a third party for such Data or information, and the account team will route all such requests to State’s designated representative.

Not sure what Appriss's proposed language is, in its entirety. Please provide proposed language in its entirety. Contractor shall not: (a) release any such Data or allow it to be released or divulge any such information to anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing; or (b)respond to any requests it receives from a third party for such Data or information, and instead route all such requets to State's designated representitiveContractor will comply with the Law, regulations, Law Enforcement and in accordance with the contract, when responding to any requests it receives from a third party for such Data or information. I don't have notes on this one. Is the below acceptable to Homeland:

Contractor shall not: (a) release any such Data or allow it to be released or divulge any such information to anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing; or (b)respond to any requests it receives from a third party for such Data or information, and instead route all such requets to State's designated representitiveContractor will comply with the Law, regulations, Law Enforcement and in accordance with the contract, when responding to any requests it receives from a third party for such Data or information. Homeland needs to review J40. Final Negotiated Langauage Shall Read As Follows:

Contractor shall not: (a) release any such Data or allow it to be released or divulge any such information to anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing; or (b)respond to any requests it receives from a third party for such Data or information, and instead route all such requets to State's designated representitive. Notwithstanding (b), Contractor will comply with the Law, regulations, Law Enforcement and in accordance with the contract, when responding to any requests it receives from a third party for such Data or information, and will inform the State when any such requests are made.

14.4 PHI Protected Health Information. Contractor warrants that, to the extent performance under Contract involves individually identifiable health information (referred to hereinafter as protected health information (“PHI”) and electronic PHI (“ePHI”) as defined in the Privacy Rule referred to below), it:

14.4.1. is familiar with and will comply with the applicable aspects of the following collective regulatory requirements regarding patient information privacy protection: (a) the “Privacy Rule” in CFR 45 Part 160 and Part 164 pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) of 1996; (b) Arizona laws, rules, and regulations applicable to PHI/ePHI that are not preempted by CFR45-160(B) or the Employee Retirement Income Security Act of 1974 (“ERISA”) as amended; and (c) State’s current and published PHI/ePHI privacy and security policies and procedures;

14.4.2. will cooperate with State in the course of performing under the Contract so that both State and Contractor stay in compliance with the requirements in (1) above; and

14.4.3. will sign any documents that are reasonably necessary to keep both State and Contractor in compliance with the requirements in (1) above, in particular “Business Associate Agreements” in accordance with the Privacy Rule. Protected Health Information Contractor warrants that, to the extent performance under Contract involves individually identifiable health information (referred to hereinafter as protected health information (“PHI”) and electronic PHI (“ePHI”) will comply with the applicable aspects of the following collective regulatory requirements.

Nothing contained herein shall be construed to grant the Contractor any ownership rights in data supplied by the State to the Contractor in connection with this Contract. Further, Contractor shall not use any data it receives from victims of crime, or data it receives from the State or any third party pertaining to victims of crime, except for the provision of the Services set forth in this Scope of Work.

Contractor builds and maintains databases and solutions utilizing data from disparate incarceration systems. The hygiene, maintenance and storage of this incarceration data improves data quality and solutions for all clients seeking to manage risk, security and fraud (collectively “Risk Solutions”).