9-Exhibit J.9 Data Use and Non-Disclosure Agreement.pdf

EMPL3 (03/22) Page 1 of 3

TEXAS DEPARTMENT OF CRIMINAL JUSTICE

DATA USE AND NON-DISCLOSURE AGREEMENT

NAME: SSN:

ORGANIZATION: DEPT:

POSITION:

PLEASE READ THE FOLLOWING AGREEMENT CAREFULLY AND COMPLETELY BEFORE SIGNING.

This Agreement applies to employees, contract employees, consultants, vendors, interns, volunteers, and other individuals of the Texas Department of Criminal Justice (hereafter referred to as “TDCJ”) who handle confidential and sensitive information, including financial, medical, personnel, criminal justice, or student data and pertains to all state-owned or controlled information resources.

The purpose of this Agreement is to inform you of your principal obligations concerning the use of TDCJ information resources and to document your Agreement to abide by these obligations.

"Information Resources" has the meaning defined in Texas Government Code § 2054.003(7) as “. . .the procedures, equipment, and software that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and associated personnel including consultants and contractors.” Additionally, data impacted by the aforementioned is included as information resources.

Under 1 Texas Administrative Code § 202.22(3), “the user of an information resource has the responsibility to:

(A) use the resource only for the purpose specified by the agency or information-owner;

(B) comply with information security controls and agency policies to prevent unauthorized or accidental disclosure, modification, or destruction; and

(C) formally acknowledge that they will comply with the security policies and procedures in a method determined by the agency head or his or her designated representative.”

CONFIDENTIAL AND SENSITIVE INFORMATION:

As an employee, contract employee, consultant, vendor, intern, volunteer, or other individual of the TDCJ, you may have access to confidential or sensitive information through use of TDCJ information resources or through your associated activities with TDCJ information systems. Confidential and sensitive information includes identifying information, federal tax information, personal health information, criminal justice information, or any information that is classified as confidential or sensitive by federal or state law, by TDCJ policy, or is defined as “Personal Identifying Information” or “Sensitive Personal Information” under Texas Business and Commerce Code § 521.002(a)(1)-(2). Under 1 Texas Administrative Code § 202.1(22), an information system includes an interconnected set of information resources under the same direct management control that shares common functionality. An information system normally includes hardware, software, network infrastructure, information, applications, communications, and people.

As a user of TDCJ information systems, you are required to conform to applicable laws and TDCJ policies governing confidential and sensitive information.

Your principal obligations in this area are outlined below. You are required to read and to abide by these obligations.

I UNDERSTAND THAT:

I may have access to confidential and sensitive information related to:

• Inmates, customers, employees, users, contractors, and volunteers. This may include records, conversations, applications, or financial information by which the identity of a person can be determined, either directly OR indirectly.

• TDCJ functions, such as information protected by the attorney-client and attorney work product privilege, financial information, employment records, contracts, federal tax information, internal reports, memos, and communications.

• Third parties to include vendor and customer information and contracts.

696-BF-26-O033 Exhibit J.9

EMPL3 (03/22) Page 2 of 3

NAME: SSN:

I AGREE THAT:

• I will, at all times, safeguard and retain the confidentiality, integrity, and availability of confidential and sensitive information.

• I will only access confidential and sensitive information for business needs.

• I will not in any way divulge, copy, release, sell, loan, review, alter, or destroy any confidential or sensitive information, except as authorized.

• I will not misuse or carelessly handle confidential and sensitive information.

• I will encrypt confidential and sensitive information when appropriate, including when emailing such information outside the TDCJ and when storing such information on portable electronic devices and portable storage devices.

• I will safeguard and not disclose my password or other authorization I have that allows me to access confidential and sensitive information, except as permitted by law.

• I will report activities by any other individual or entity that I suspect may compromise the confidentiality, integrity, or availability of confidential and sensitive information.

• My privileges hereunder are subject to periodic review, revision, and if appropriate, renewal.

• I have no right or ownership interest in any confidential or sensitive information referred to in this Agreement. The TDCJ may revoke my access to confidential and sensitive information at any time and without notice.

AUTHORIZED USE – I AGREE THAT:

• I will use information resources only for official state-approved business.

• I will not use information resources for personal reasons unless there are specific limited use exceptions permitted by the TDCJ division to which I am assigned.

• I have no right to expect privacy in my use of TDCJ information resources or in the content of my communications sent or stored in TDCJ information resources. All user activity is subject to monitoring, logging, and review.

• I will NOT attempt to circumvent the computer security system by using or attempting to use any transaction, software, files, or resources I am not authorized to use.

PERSONAL SECURITY IDENTIFICATION CODES (USER IDS AND PASSWORDS) - I AGREE THAT:

• I will receive and be required to use a personal security identification code (user ID and password) to gain access to and to utilize information resources.

• My user ID and password are security measures that must be used only by me and I will not disclose my password to anyone. The only exception is in the event an information technology specialist requires the password to resolve an access problem. Once the problem has been corrected, I will immediately change my password.

• I will be held personally responsible for any transactions initiated, actions taken, or for any harm, loss, or adverse consequences arising from the use of my user ID and password, including any unauthorized use by a third party if such party gains access to my user ID and password due to my misconduct or failure to abide by TDCJ policy.

COPYRIGHTED MATERIAL - I AGREE THAT:

• Any copyrighted material, including but not limited to commercial computer software, which may be made available, is protected by copyright laws and is NOT to be copied for any reason without permission from the copyright holder.

• I will only install or use software on TDCJ computers that has been properly licensed and approved for my use in accordance with TDCJ policies and procedures.

• If installing or authorizing the installation of software on TDCJ computers, I will be responsible for ensuring that such software is only used in a manner that complies with the terms of the applicable software license agreement and all applicable TDCJ policies and procedures.

ACCESS TO DATA - I AGREE THAT:

• Proper authorization is required for access to all data owned by the TDCJ, except data that has been authorized by the TDCJ for public access.

• I will not attempt to access or alter any data that I am not authorized to access in the performance of my job duties.

EMPL3 (03/22) Page 3 of 3

Note to Employee, Contract Employee, Consultant, Vendor, Intern, Volunteer, or Other Individual: With few exceptions, you are entitled upon request: (1) to be informed about the information the TDCJ collects about you; and (2) under Texas Government Code §§ 552.021 and 552.023, to receive and review the collected information. Under Texas Government Code § 559.004, you are also entitled to request, in accordance with TDCJ procedures, that incorrect information the TDCJ has collected about you be corrected.

NAME: SSN:

• I will not use TDCJ information resources to review, alter, or otherwise act to obtain access to information about myself, or any relative, friend, or business associate.

• I will use appropriate measures to prevent others from obtaining access to TDCJ data, such as securing my workstation either by logging off or using a password-protected screen saver.

o I will log off or activate a password-protected screen saver before leaving a workstation with access to files containing confidential or sensitive information.

o I will follow TDCJ policies and procedures for the release of information if I receive a request for the release of TDCJ information or data.

SECURITY OF EQUIPMENT - I AGREE THAT:

• I will not remove information resources from TDCJ property without prior authorization and approval from the appropriate authority.

• I will immediately report all security incidents, including the loss or theft of any information resources or data, to agency management and to the TDCJ information security officer.

I AGREE THAT:

• I am required to be aware of, read, and comply with the information in the TDCJ Information Security Policy found at http://itd.tdcj.texas.gov/irsp.html.

• I must comply with the policies concerning information resources set out in the TDCJ policies and procedures manual, as well as any changes to those policies.

• I must comply with the information security policies, standards, and guidelines of the TDCJ division that employs me, including any changes to those policies, standards, and guidelines.

• My failure to comply with this Agreement may result in loss of access privileges to TDCJ information resources or other disciplinary action up to and including dismissal for employees; termination or alteration of employment relations in the case of contract employees, consultants, vendors, or other individuals; or dismissal for interns and volunteers. Additionally, I could also be subject to civil liability or criminal charges, including “Breach of Computer Security” as defined by Texas Penal Code § 33.02.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT:

As an employee, contract employee, consultant, vendor, intern, volunteer, or other individual of the TDCJ, you may have access to protected health information (PHI), including demographic data, that relates to an individual’s past, present, or future phys ical or mental health or condition; the provision of health care to the individual; or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.

I AGREE THAT:

• In accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 C.F.R. Part 160 and Part

164, and ED-02.01, “TDCJ Ethics Policy,” I shall ensure the confidentiality and security of PHI when it is transferred, received, handled, or shared. This applies to all forms of protected health information, including electronic, oral, and paper.

Signature: Date:

Distribution of Original Form:

Employee: Master human resources file Contract Employee or Intern: Separate unit or department file Consultant or Vendor: Appropriate department or division Volunteer: Volunteer Services department Other Individual: Appropriate department or division http://itd.tdcj.texas.gov/irsp.html