Appendix D - DSBNA - Transmission to IRIS Services RFP.docx

APPENDIX D

DATA SECURITY AND BREACH NOTIFICATION AGREEMENT

DATA SECURITY AND BREACH NOTIFICATION AGREEMENT

All capitalized terms not defined in this Data Security and Breach Notification Agreement (“Agreement”) shall have the meaning ascribed to them in the Contractual Agreement (“Contract”) between the Employees Retirement System of Texas (“ERS”) and _____________ (“CONTRACTOR”).

Article 1. Purpose

1.1 To ensure continued security for ERS, its members, annuitants, retirees, participants, alternate payees, and beneficiaries (collectively “Member”) and their respective Personal Data (as hereinafter defined), and to mitigate the risk of identity theft and fraud, CONTRACTOR agrees to be bound by the provisions contained in this Agreement.

Article 2. Specific Requirements

2.1 CONTRACTOR, including its affiliates, subsidiaries, representatives, officers, directors, principals, employees, agents, assigns, and any subcontractors and independent contractors (“Agents”), as a condition of handling Members personally identifying and / or sensitive personal information and, if applicable, protected health information (“PHI”) (together, “Personal Data”) (i) must annually, or more frequently upon request of ERS, issue certificates of compliance with this exhibit to ERS, and (ii) provide evidence of compliance as described in the Contract, to ERS in accordance with §2054.138 of the Texas Government Code .

2.2 All Personal Data must be processed fairly and lawfully, according to the laws and regulations of the United States of America and the state of Texas. CONTRACTOR shall comply with the Privacy Act of 1974, Computer Matching and Privacy Protection Act of 1988, Texas Business and Commerce Code, ch. 521 and information security standards as outlined in Title 1, Texas Administrative Code ch. 202. Further, CONTRACTOR shall comply with all applicable federal and state laws and regulations pertaining to the handling and use of Personal Data. In the event of a conflict between applicable laws, the Contract and this Agreement, the strictest provision or provisions offering protections to ERS and its Members shall apply.

2.3 The amount of Personal Data collected must be adequate, relevant and not excessive in relation to the purposes for which it is collected or for which it is further processed. If applicable, PHI must be collected only for purposes consistent with what is communicated to the Member and not further processed in a way incompatible with those purposes. All other Personal Data must be collected only for purposes as necessary for CONTRACTOR to perform and fulfill its obligations under the Contract and not further processed in a way incompatible with those purposes. Further processing of such Personal Data for historical, statistical, or other business purposes is not incompatible with the original purpose, provided it is permitted under the Contract and the further processing includes adequate additional controls protecting the rights of the Member.

2.4 If CONTRACTOR serves as a recordkeeper for ERS or collects data on behalf of ERS, all Personal Data must be accurate and complete, and where necessary, kept up to date. Every reasonable step must be taken to ensure that Personal Data that is inaccurate or incomplete, keeping in mind the purposes for which it was collected or for which it is further processed, is definitively erased or corrected in accordance with applicable law.

2.5 If CONTRACTOR did not execute a Business Associate Agreement (“BAA”) in connection with the Contract, but CONTRACTOR subsequently receives or handles any PHI, CONTRACTOR agrees to immediately notify ERS. ERS will then determine, in ERS’ sole discretion, whether CONTRACTOR must execute a BAA to address the privacy, security and breach notification requirements related to PHI. If applicable, CONTRACTOR agrees to act in good faith and to cooperate in the execution of a BAA.

2.6 CONTRACTOR shall maintain industry-accepted standards, such as those recommended by the National Institute of Standards and Technology (NIST), and shall incorporate other applicable state and federal laws and regulations regarding the confidentiality, integrity, accessibility and availability of Personal Data, including, but not limited to, maintenance of disaster recovery and business continuity plans. CONTRACTOR agrees to allow ERS to view these standards and plans upon request onsite at ERS’ premises.

2.7 CONTRACTOR shall maintain computer files containing Personal Data in a secure, hardened facility which provides environmental and access controls. All computer files containing Personal Data, including, but not limited to, duplicate or backup copies, shall be encrypted while at rest and in transit. Additionally, all mobile devices, including, but not limited to, laptop computers, and external storage devices which contain, process or interact with ERS data, including, but not limited to, Personal Data, shall be encrypted at all times.

2.8 Except as specifically permitted by ERS, Personal Data must not be kept in a form that permits identification of Members for any longer than is necessary for the purposes for which the data was collected or for which it is further processed. For example, this can be implemented with linked separate files that contain identification information and related sensitive information, respectively.

Article 3. Processing Confidentiality and Security

3.1 Personal Data shall not be stored, made available to or viewed by any person or entity (including any Agent of CONTRACTOR), in any fashion, no matter what technology is employed, at any location outside the fifty (50) states of the United States of America. Personal Data is made available to a person or entity in violation of this prohibition whenever it is possible for a person or entity to view Personal Data from outside the United States, whether or not the Personal Data is actually sent out of the United States or is actually viewed by someone outside the United States.

3.2 When building, testing, enhancing and maintaining processing systems that contain, or will contain, Personal Data, developers must not use actual Personal Data. Instead, they must use fictional or sanitized data that preserves the essential characteristics of the Personal Data, but that does not relate to identifiable individuals. In emergency situations where processing with actual Personal Data is required, use of such information may be permitted only if security procedures are approved in advance, in writing, by ERS’ Executive Director, General Counsel, and Information Security Officer.

3.3 All authentication access to processing systems and networks containing Personal Data must be logged so that access attempts to systems and networks containing Personal Data can be traced to a specific user. CONTRACTOR is responsible for monitoring and following up on potential security-relevant events.

3.4 When no longer needed, or as required by applicable state or federal law or the Contract, all copies of Personal Data, including, but not limited to, copies on backup tapes, must be irreversibly destroyed according to standards and procedures as provided in the Contract and applicable law. A document describing the Personal Data destroyed, the reasons for such destruction, date and manner thereof and who performed such destruction must be prepared for each destruction process and promptly submitted to ERS. Permission to destroy Personal Data may be granted only by ERS, and only if all legal retention requirements and related business and auditing purposes have been met, and as consistent with the terms of the Contract. In the event there is any litigation or investigative proceedings related to the Personal Data or CONTRACTOR’s performance under the Contract or this Agreement, then the Personal Data must be retained during the pendency of such litigation or investigative proceedings.

Article 4. Data Breach Monitoring and Notification

4.1 CONTRACTOR must take proactive steps to monitor for breaches of system security, including, but not limited to, acquisition, access, use or disclosure of Personal Data (each, a “Notification Event”). In the event of such a Notification Event, CONTRACTOR must notify ERS immediately, but in any event within 24 hours from the time the Notification Event is discovered or reasonably should have been discovered with the exercise of reasonable diligence, whichever is earlier. The primary contact for notification at ERS is the General Counsel (general.counsel@ers.texas.gov). At any time upon request of ERS, CONTRACTOR must notify, at CONTRACTOR’s expense, the affected Member (s), including those Member reasonably believed to have been affected, as quickly as possible, but in any event within 72 hours from the time the Notification Event is discovered, unless requested to withhold notification by law enforcement or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

4.2 If CONTRACTOR is required to notify at one time more than 10,000 Member of a Notification Event, pursuant to applicable law, CONTRACTOR shall also notify, without unreasonable delay, all consumer reporting agencies that maintain files on consumers on a nationwide basis of the timing, distribution, and content of the notices.

4.3 In addition to indemnification of the Indemnified Parties pursuant to the Contract and any criminal or civil penalties, including injunctive relief, that may apply, CONTRACTOR AGREES TO DEFEND, INDEMNIFY, SAVE AND HOLD HARMLESS, AND TO PROVIDE, AT CONTRACTOR’S SOLE COST AND EXPENSE, ONE (1) YEAR OF CREDIT MONITORING SERVICE TO, ANY PARTICIPANT(S) WHOSE PERSONAL DATA HAS BEEN DISCLOSED PURSUANT TO A NOTIFICATION EVENT. ERS will designate the vendor that will provide the credit monitoring service.

IN WITNESS WHEREOF, the parties have executed this Agreement to be effective upon execution by both parties.

By: __________________________

By: __________________________

Printed Name: _________________ Porter Wilson

Title: _________________________ Executive Director

Date: ________________________

Date: ________________________

Appendix D - Data Security and Breach Notification Agreement Page 1 of 2 ERS Transmission to Information Returns Intake System (IRIS) Services RFP