KATHY HOCHUL

Governor

Empire State Plaza, P.O. Box 2062, Albany, NY 12220-0062 │www.its.ny.gov

This packet contains the following:

1. ITS NDA Form ............................................................................................ Read, Complete, Sign, & have Notarized

2. CJIS Security Form .................................................................................... Read & Sign

3. HIPAA Compliance Form ........................................................................... Read & Sign

4. DTF-202 Tax Forms.................................................................................... Read, Complete, & Sign

5. FTI Appendix Tax Forms............................................................................. Read & Sign

6. OTDA Confidentiality/Non-Disclosure Agreement Read & Sign

7. DOL Acknowledgement of Confidentiality of IRS return Information

8. DOL- Employee acknowledgement of new hire information confidentiality

9. Wage Record Interchange System

10. Commission on Ethics and Lobbying in Government

11. OCFS Confidentiality Non-Disclosure Form………………………………….

Read, Complete, & Sign

Read, Complete, & Sign

Read, Complete, & Sign

Read & Sign

Read, Complete, & Sign

Read, Complete, & Sign12. ITS Confirmation of No Material Misrepresentation ………………………….

CONSULTANT CONFIDENTIALITY & NON-DISCLOSURE AGREEMENT

THIS AGREEMENT is between the State of New York (“State”), acting by and through the New York

State Office of Information Technology Services (“ITS”), having its principal place of business at State

Capitol, Empire State Plaza, Albany, New York 12220-0062, and ________________________________

(“Consultant”), an employee or subcontractor of __________________________________ (“Contractor”) with its principal place of business at __________________________________________. This Agreement is signed in relation to the provision by Consultant of services to ITS under Contract/Statement of Work

No. ________________________ (hereinafter “Engagement”).

1. Definitions. For the purposes of this Agreement, the following terms shall be defined as follows:

I. Confidential Information

“Confidential Information” shall be defined to include any information that ITS or the State, regardless of form or medium of disclosure (e.g., verbal, hard copy, or electronic) or source of information (e.g., ITS, other state agencies, state employees, electronic systems, or third party contractors) provides to Consultant, or which Consultant obtains, discovers, derives or otherwise becomes aware of as a result of the

Engagement other than:

(a) information that is previously rightfully known to Consultant without restriction on disclosure;

(b) information that is or becomes, from no act or failure to act on the part of the Consultant, generally known in the relevant industry or in the public domain; or

(c) information that is independently developed by Consultant without the use of Confidential

Information.

II. Authorized Person

“Authorized Person” shall be defined as a person authorized by ITS as having a need to receive, possess, store, access, view and/or use Confidential Information for an Authorized Use.

III. Authorized Use

“Authorized Use” shall be defined as the use of Confidential Information by Consultant or Authorized

Persons, solely for the purpose of performing the Engagement.

2. Term

Consultant’s obligations under this Agreement shall commence upon the execution of this Agreement or the start of the Engagement, whichever occurs first, and shall survive in perpetuity.

3. Duty to Protect Confidential Information

Consultant agrees not to disclose Confidential Information to anyone, except as provided in this Agreement.

In addition, Consultant shall safeguard all Confidential Information from unauthorized access, loss, theft, destruction, and the like. Consultant shall notify ITS immediately upon becoming aware that confidential information is in the possession of or has been disclosed to an unauthorized person or entity.

4. Press Releases

Consultant shall not issue any press releases, give or make any presentations, or give to any print, electronic or other news media information regarding his/her Engagement - nor shall Consultant authorize or permit any other person or entity to do so - without ITS’s prior written approval. Consultant shall immediately refer any media requests or other requests for information to ITS.

ITS NDA FORM

Consultant Confidentiality & Non-Disclosure Agreement

5. Use Restriction

Consultant shall not receive, possess, store, access, view and/or use Confidential Information for any purpose other than an Authorized Use. Consultant shall not permit unauthorized persons or entities to gain access to Confidential Information and shall not divulge methods of accessing Confidential Information to unauthorized persons.

6. Security Obligations Regarding Confidential Information

Consultant agrees to comply with the following security obligations as well as any other such obligations conveyed to him/her during the course of the Engagement in accordance with the Engagement’s scope of work:

a. Unless otherwise authorized by ITS, Confidential Information may NOT be stored on personal (non-ITS) computing or other electronic or mobile storage devices, or taken or removed in any form from ITS.

b. Consultant shall comply with all federal and State laws.

c. Consultant shall comply with all ITS policies and procedures including but not limited to those that provide for accessing, protecting and preserving State assets.

d. Consultant shall take no action to intrude upon, disrupt or deny services to ITS.

e. Consultant shall use only those access rights granted by ITS.

7. Certification by Consultant of Return of Confidential Information

Upon termination of the Engagement, Consultant shall return Confidential Information stored in a tangible format to ITS, or destroy such Confidential Information that Consultant possesses in a format that cannot be returned, and further agrees to submit to ITS on Contractor’s letterhead, a Certification of Return or

Destruction of Confidential Information certifying that all copies of Confidential Information have been returned or destroyed.

8. Termination

Consultant’s Authorized Use of Confidential Information shall terminate automatically upon the first to occur of any of the following: (a) breach of this Agreement; (b) completion or termination of Consultant’s

Engagement; or, (c) termination of Contractor’s State contract.

9. Compliance

Should Consultant breach this Agreement, the State shall have all equitable and legal rights (including the right to obtain injunctive relief) to seek redress for such breach, prevent further breaches and to be fully compensated (including litigation costs and reasonable attorney’s fees) for losses or damages resulting from such breach. Consultant acknowledges that compensation for damages may not be sufficient and that injunctive relief to prevent or limit any breach of confidentiality may be the only viable remedy available to ITS.

10. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of New York.

If any provision of Agreement is declared by a court of competent jurisdiction to be invalid, illegal, or unenforceable, the other provisions shall remain in full force and effect.

Consultant Confidentiality & Non-Disclosure Agreement

IN WITNESS WHEREOF, Consultant has signed this Agreement as of the date set forth below.

By: ____________________________________

Signature

Name

Date

Acknowledgment for Consultant Confidentiality & Non-Disclosure Agreement

} scilicet

STATE OF __________________

COUNTY OF ________________ }

On the ___ day of _______ in the year ___, before me personally appeared

________________________, personally known to me or proved to me on the basis of satisfactory evidence to be the individual whose name is subscribed to the foregoing Consultant Confidentiality & Non-Disclosure Agreement

(instrument) and acknowledged to me that (s)he executed the same in her/his capacity, and on her/his own behalf.

Notary Public

Registration No.

10/01/2022

CJISD-ITS-DOC-08140-5.9.1

H-6

FEDERAL BUREAU OF INVESTIGATION

CRIMINAL JUSTICE INFORMATION SERVICES

SECURITY ADDENDUM

The goal of this document is to augment the CJIS Security Policy to ensure adequate security is provided for criminal justice systems while (1) under the control or management of a private entity or (2) connectivity to FBI CJIS Systems has been provided to a private entity (contractor). Adequate security is defined in Office of Management and Budget Circular A- 130 as “security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.”

The intent of this Security Addendum is to require that the Contractor maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

This Security Addendum identifies the duties and responsibilities with respect to the installation and maintenance of adequate internal controls within the contractual relationship so that the security and integrity of the FBI's information resources are not compromised. The security program shall include consideration of personnel security, site security, system security, and data security, and technical security.

The provisions of this Security Addendum apply to all personnel, systems, networks and support facilities supporting and/or acting on behalf of the government agency.

1.00 Definitions

1.01 Contracting Government Agency (CGA) - the government agency, whether a Criminal Justice Agency or a Noncriminal Justice Agency, which enters into an agreement with a private contractor subject to this Security Addendum.

1.02 Contractor - a private business, organization or individual which has entered into an agreement for the administration of criminal justice with a Criminal Justice Agency or a Noncriminal Justice Agency.

2.00 Responsibilities of the Contracting Government Agency.

2.01 The CGA will ensure that each Contractor employee receives a copy of the Security Addendum and the CJIS Security Policy and executes an acknowledgment of such receipt and the contents of the Security Addendum. The signed acknowledgments shall remain in the possession of the CGA and available for audit purposes. The acknowledgement may be signed by hand or via digital signature (see glossary for definition of digital signature).

3.00 Responsibilities of the Contractor.

3.01 The Contractor will maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed and all subsequent versions), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

4.00 Security Violations.

H-7

4.01 The CGA must report security violations to the CJIS Systems Officer (CSO) and the Director, FBI, along with indications of actions taken by the CGA and Contractor.

4.02 Security violations can justify termination of the appended agreement.

4.03 Upon notification, the FBI reserves the right to:

a. Investigate or decline to investigate any report of unauthorized use;

b. Suspend or terminate access and services, including telecommunications links. The

FBI will provide the CSO with timely written notice of the suspension. Access and services will be reinstated only after satisfactory assurances have been provided to the FBI by the CGA and Contractor. Upon termination, the Contractor's records containing CHRI must be deleted or returned to the CGA.

5.00 Audit

5.01 The FBI is authorized to perform a final audit of the Contractor's systems after termination of the Security Addendum.

6.00 Scope and Authority

6.01 This Security Addendum does not confer, grant, or authorize any rights, privileges, or obligations on any persons other than the Contractor, CGA, CJA (where applicable), CSA, and

FBI.

6.02 The following documents are incorporated by reference and made part of this agreement: (1) the Security Addendum; (2) the NCIC 2000 Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20. The parties are also subject to applicable federal and state laws and regulations.

6.03 The terms set forth in this document do not constitute the sole understanding by and between the parties hereto; rather they augment the provisions of the CJIS Security Policy to provide a minimum basis for the security of the system and contained information and it is understood that there may be terms and conditions of the appended Agreement which impose more stringent requirements upon the Contractor.

6.04 This Security Addendum may only be modified by the FBI, and may not be modified by the parties to the appended Agreement without the consent of the FBI.

6.05 All notices and correspondence shall be forwarded by First Class mail to:

Information Security Officer Criminal Justice Information Services Division, FBI 1000 Custer Hollow Road Clarksburg, West Virginia 26306

H-8

FEDERAL BUREAU OF INVESTIGATION

CRIMINAL JUSTICE INFORMATION SERVICES

SECURITY ADDENDUM

CERTIFICATION

I hereby certify that I am familiar with the contents of (1) the Security Addendum, including its legal authority and purpose; (2) the NCIC Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20, and agree to be bound by their provisions.

I recognize that criminal history record information and related data, by its very nature, is sensitive and has potential for great harm if misused. I acknowledge that access to criminal history record information and related data is therefore limited to the purpose(s) for which a government agency has entered into the contract incorporating this Security Addendum. I understand that misuse of the system by, among other things: accessing it without authorization; accessing it by exceeding authorization; accessing it for an improper purpose;

using, disseminating or re-disseminating information received as a result of this contract for a purpose other than that envisioned by the contract, may subject me to administrative and criminal penalties. I understand that accessing the system for an appropriate purpose and then using, disseminating or re-disseminating the information received for another purpose other than execution of the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend upon whether or not I receive additional compensation for such authorized activity. Such exposure for misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and federal crimes.

Printed Name/Signature of Contractor Employee Date

Printed Name/Signature of Contractor Representative Date

Organization and Title of Contractor Representative

Compliance with HIPAA (Health Insurance Portability And Accountability Act Of 1996), HI-

TECH (Health Information Technology for Economic and Clinical Health Act of 2009), and other

Health Information Privacy and Security Laws

Definitions:

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA

Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

(a) Business Associate. “Business Associate” shall generally have the same meaning as the term

“business associate” at 45 CFR 160.103, and in this Agreement may refer to Contractor or its subcontractor(s), to the extent Contractor or its subcontractor(s) create, receive, maintain, or transmit protected health information on behalf of ITS.

(b) Covered Entity. By entering into this Agreement, ITS does not affirm that it necessarily meets the definition of a “Covered Entity” or a "Business Associate" under the HIPAA statute, and rather affirms that ITS may in a given instance be acting as a "conduit" or in another capacity providing services to other entities, some of which themselves may be covered entities. But to the extent ITS is deemed to be covered by HIPAA or HI-TECH, the parties agree the term "Covered Entity" in this Agreement shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103.

(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and

Enforcement Rules at 45 CFR Part 160 and Part 164.

(d) "Medicaid Confidential Data" (MCD) includes all information about a Medicaid recipient or applicant, including enrollment information, eligibility data and protected health information. The NYS

Department of Health (DOH) is the Single State Agency responsible for the administration of the New

York State Medicaid program in New York State, including ensuring the security and confidentiality of

MCD data.

HIPAA Protected Health Information Obligations and Activities of Contractor

To the extent Contractor or its subcontractor(s) create, receive, maintain, or transmit protected health information on behalf of ITS pursuant to their responsibilities under this Agreement, Contractor agrees that it is subject to, will abide by, and will require in writing its subcontractors to similarly abide by, the following requirements applicable to Business Associates under HIPAA, agreeing to:

(a) Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law;

(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;

(c) Report to ITS within ten (10) business days or fewer any use or disclosure of protected health information not provided for by this Agreement of which it becomes aware. In no event shall Contractor exceed the timeframe for reporting to ITS breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware. Contractor shall provide ITS all

HIPAA COMPLIANCE FORM

information reasonably requested by ITS concerning any breach. Contractor shall also provide the following information to ITS upon first instance of the notification of breach: the identification of each individual whose unsecured protected health information has been, or is reasonably believed by

Contractor, to have been, accessed, acquired, used, or disclosed during the breach.

(d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of

Contractor agree in writing to the same restrictions, conditions, and requirements that apply to Contractor with respect to such information;

(e) Make available protected health information in a designated record set to ITS, in a manner to be prescribed by ITS within a reasonable timeframe not to exceed fifteen (15) days, absent extenuating circumstances, as necessary to satisfy obligations which ITS or the entities it provides services to reasonably believe applicable to them under 45 CFR 164.524. In the event Contractor or its subcontractor(s) receive any request for such protected health information directly from an individual, Contractor shall refer such request to ITS within a reasonable timeframe not to exceed ten (10) business days.

(f) Make any amendment(s) to protected health information in a designated record set as directed by ITS pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy obligations that ITS reasonably believes it has under 45 CFR 164.526, in the manner as prescribed by ITS and within twenty

(20) business days of such request. In the event Contractor or its subcontractor(s) receive any request to amend a data set directly from an individual, Contractor shall refer such request to ITS within a reasonable timeframe not to exceed ten (10) business days;

(g) Maintain and make available the information required to provide an accounting of disclosures to ITS as necessary to satisfy obligations that ITS reasonably believes it has under 45 CFR 164.528, in the manner as prescribed by ITS and within ten (10) business days of such request. In the event Contractor or its subcontractor(s) receive any request for an accounting of disclosures directly from an individual, Contractor shall refer such request to ITS within a reasonable timeframe not to exceed ten (10) business days;

(h) To the extent Contractor or its subcontractor(s) are to carry out one or more of obligation(s) ITS may have under Subpart E of 45 CFR Part 164, in performing such obligations, comply with the requirements of Subpart E that apply to ITS; and

(i) Make either Contractor's or its subcontractor(s)', or both's, internal practices, books, and records available to the Secretary of the Department of Health and Human Services and the Director of ITS, or his or her designee, for purposes of determining compliance with the HIPAA and HI-TECH Rules.

Permitted Uses and Disclosures of Protected Health Information by Contractor and its

Subcontractor(s)

(a) Contractor and its subcontractor(s) may only use or disclose protected health information as necessary to perform the services set forth in this Agreement, provided however, that if de-identified information can be used in lieu of individually identifiable health information with the same effect, Contractor and its subcontractor(s) shall use de-identified information in their performance of this Agreement in accordance with 45 CFR 164.514(a)-(c).

(b) Contractor and its subcontractor(s) may use or disclose protected health information as required by law.

(c) Contractor and its subcontractor(s) agrees to make only those uses, disclosures and requests for protected health information that are consistent with the minimum necessary policies and procedures of

ITS or the entit(ies) for whom ITS provides services which entail the creation, reception, maintenance, or transmittal of protected health information.

(d) Contractor and its subcontractor(s) may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 except as may be provided for in this Agreement or for the proper management and administration of Contractor or its subcontractor(s), including the carrying out of the Contractor's or its subcontractor(s)' legal responsibilities.

Other Health Information Obligations and Activities of Contractor

Contractor or its subcontractor(s) may not disclose other types of health information protected by State or federal law including personally identifiable mental health information protected under NYS Mental

Hygiene Law §33.16, other personally identifiable health information or HIV information protected under

NYS Health Law sections §18 or Article 27-F, or substance abuse information protected under federal regulations 42 CFR Part 2.

Contractor or its subcontractor(s) may not disclose Medicaid Confidential Data without the prior written approval of the New York State Department of Health (DOH), either directly or as provided to Contractor or its subcontractor(s) through ITS. If contacted by DOH, while also informing ITS, contractor or its subcontractor(s) shall reasonably work with DOH to identify any individuals who may have inappropriately or unlawfully accessed Medicaid Confidential Data.

The federal Center for Medicare and Medicaid Services (CMS) requires that all contracts and/or agreements executed between the Department of Health and any second party that will receive Medicaid

Confidential Data must include contract language that will bind such parties to ensure that contractor(s) abide by the regulations and laws that govern the protection of individual, Medicaid confidential level data.

Medicaid Confidential Data includes all information about a recipient or applicant, including enrollment information, eligibility data and protected health information.

You must comply with the following state and federal laws and regulations:

• Section 367b(4) of the NY Social Services Law

• New York State Social Services Law Section 369 (4)

• NYS Mental Hygiene Law §33.16,

• Article 27-F of the New York Public Health Law & 18 NYCRR 360-8.1

• Social Security Act,42 USC 1396a (a)(7)

• Federal regulations at 42 CFR 431.302, 42 C.F.R. Part 2

• The Health Insurance Portability and Accountability act (HIPAA), at 45 CFR Parts 160 and 164

Please note that Medicaid Confidential Data released to you may contain AIDS/HIV related confidential information as defined in Section 2780(7) of the New York Public Health Law. As required by New

York Public Health Law Section 2782(5), the following notice is provided to you:

“This information has been disclosed to you from confidential records which are protected by state law.

State law prohibits you from making any further disclosure of this information without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. Any unauthorized further disclosure in violation of state law may result in a fine or jail sentence or both. A general authorization for the release of medical or other information is NOT sufficient authorization for the release for further disclosure.”

Alcohol and Substance Abuse Related Confidentiality Restrictions:

Alcohol and substance abuse information is confidential pursuant to 42 C.F.R. Part 2. General authorizations are ineffective to obtain the release of such data. The federal regulations provide for a specific release for such data.

You agree to ensure that you and any agent, including a subcontractor, to whom you provide Medicaid

Confidential Data, agrees to the same restrictions and conditions that apply throughout this Agreement.

Further, you agree to state in any such agreement, contract or document that the part to whom you are providing the Medicaid Confidential Data may not further disclose it without the prior written approval of the New York State Department of Health. You agree to include the notices preceding, as well as references to statutory and regulatory citations set forth above, in any agreement, contract or document that you enter into that involves Medicaid Confidential Data.

Term and Termination

(a) Termination for cause under HIPAA or HI-TECH. The Term of this Agreement shall be as described elsewhere in the "Term" section of this agreement. Among the other reasons for which ITS may terminate this Agreement prior to the end of its Term date for cause, ITS may terminate this

Agreement if ITS determines the Contractor or its subcontractor(s) have violated a material term of this

HIPAA and HI-TECH Compliance section of the Agreement, and Contractor or its subcontractor(s) have not cured the breach or ended the violation within any time that has been specified by ITS.

(b) Contractor's and its Subcontractor(s)' Obligations Upon Termination. Upon termination of this

Agreement for any reason, Contractor and its subcontractor(s) shall return to ITS, transfer to another of

ITS' contractors as directed by ITS, or, if agreed to by ITS on an individual case-by-case basis, destroy all protected health information received from ITS, or created, maintained, or received by the Contractor and its subcontractor(s) on behalf of ITS, that the Contractor and its subcontractor(s) still maintain in any form. Contractor and its subcontractor(s) shall retain no copies of the protected health information.

Contractor understands and agrees and will require of its subcontractor(s) in writing that Contractor and its subcontractor(s) are required to receive written approval from ITS prior to the return, transfer or destruction of any protected health information.

(c) Survival. Contractor's and its subcontractor(s)' obligations under this HIPAA and HI-TECH

Compliance section of this Agreement shall survive the termination of this Agreement.

Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in the HIPAA or HI-TECH

Rules means the section as in effect or as amended.

(b) Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA or HI-TECH Rules and any other applicable law.

(c) Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the

HIPAA or HI-TECH Rules.

(d) Sub-contractors. Contractor shall require any subcontractors that it uses that create, receive, maintain, or transmit protected health information on behalf of ITS under this Agreement to conform to these HIPAA and HI-TECH Compliance requirements in addition to any other security, privacy or applicable terms of this Agreement.

Contractor

By:

Signature

Name

Date

Subcontractor

By:

Signature

Name

Date

Department of Taxation and Finance

Tax Information Access and Non-Disclosure Agreement

DTF-202

(6/19)

Purpose of this form This form legally binds those who sign it to comply with the secrecy provisions of the New York State Tax Law and the Internal Revenue Code (IRC). Individuals who come into contact with, or otherwise access state or federal income tax information, are subject to the secrecy provisions of the Tax Law and the IRC and are subject to statutory penalties for violating those laws.

Unauthorized disclosure Any unauthorized disclosure is a crime punishable by fine or imprisonment, or both. It is unlawful to intentionally disclose tax information such as:

• any information contained in a tax return, report, physical document, or computer file;

• confidential systems information including functional, technical, and detailed systems design and architecture;

• automated analysis techniques, systems developed by the department, audit selection methodologies; and

• vendor products such as software packages.

Unauthorized disclosure includes:

• divulging or making known in any manner the contents disclosed in any report or return required under the Tax Law, including computer files;

• the willful browsing or accessing of taxpayer information by a person not authorized to view it; and

• accessing or viewing taxpayer information without a legitimate business or work-related need.

Violations New York State Tax Law: Any violation of the secrecy provisions of this agreement is punishable by a fine of up to $10,000, imprisonment up to one year, or both. Corporations may be subject to a fine of up to $20,000. State officers and employees making unlawful disclosures are also subject to dismissal from public office for a period of five years. [Tax Law § 1825]

New York State Penal Law: Any violation of Section 195.00 in relation to misconduct of public servants is punishable by up to one year of imprisonment. Other New York State Penal Law violations may also apply.

Internal Revenue Code: Any violation of the secrecy provisions of this agreement is punishable by a fine of up to $1,000 for each access or unauthorized disclosure, imprisonment of up to one year, or both, together with the costs of prosecution. [IRC §§ 6103, 7213, and 7213A]

Who must sign This form must be signed by:

• All officers and agents of the Tax Department.

• Any contractor or subcontractor hired by the Tax Department, including their designated employees.

• Any bank or other depository, its officers or employees, that may receive a return or report required under the Tax Law.

• Any person who is permitted by law to inspect a return or report, including employees of other NYS agencies, or who may have access to a return or report.

• Unescorted visitors to any Tax Department building or premises.

It is a crime to access your own, a friend’s or a family member’s tax information.

Violators are subject to penalties as noted below.

(continued on page 2) www.tax.ny.gov

Page 2 of 2 DTF-202 (6/19)

Access to tax information and Tax Department systems is subject to monitoring.

Individual’s signature Printed name and title of individual Date signed

Individual’s email address Individual’s phone number

Individual’s home address (house number and street) City State ZIP code

Printed name of employer

Supervisor’s name Supervisor’s title

Employer’s business address (number and street) City State ZIP code www.tax.ny.gov

Properly complete all fields and sign where indicated.

Return this completed form to: NYS TAX DEPARTMENT

OFFICE OF INTERNAL AFFAIRS

W A HARRIMAN CAMPUS

ALBANY NY 12227-0811

If not using U.S. Mail, see Publication 55, Designated Private Delivery Services.

Questions?

Call us at 518-530-4391.

We will not process this form and may revoke your access if:

• you leave any fields incomplete or blank;

• any of your entries are illegible;

• you do not sign and date where indicated;

• your signature is not original; or

• the home address you entered is not your place of residence.

Certifications By signing below, you certify the following:

• You have read the contents of this Tax Information Access and Non-Disclosure Agreement, understand the Tax Department secrecy provisions, and will adhere to these provisions even after your relationship with the Tax Department ends.

• Your access to Tax Department information is for a proper purpose and does not constitute an unauthorized disclosure.

• You have read this document and understand its contents.

Exhibit 7 Safeguarding Contract Language

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and c ontractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and t hat further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C.

552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

Contractor

Consultant

1 | P a g e

OTDA CONFIDENTIAL/NON-DISCLOSURE AGREEMENT

With regard to my work with ____________(Requestor)

I, am:

(INDIVIDUAL’s name) an employee of Requestor a volunteer with Requestor a contractor of Requestor an employee of a contractor of Requestor a volunteer with a contractor of Requestor a subcontractor to a contractor of Requestor an employee of a subcontractor to Requestor a volunteer with a subcontractor to Requestor and;

A. Access or Exposure Protected Information In General

I understand that as part of performing my duties as an employee, volunteer, contractor or subcontractor I may have access to, see or hear “Protected Information,” which, for purposes of this agreement, shall include, but not be limited to:

1. Data or information obtained from sources outside of OTDA, such as Federal Tax Information (FTI); Federal Parent Locator Services (FPLS) information;

Unemployment Insurance Benefit (UIB) information; Social Security Administration (SSA) information; and, Medicaid (MA) information.

2. Data or information maintained in and/or obtained from OTDA-owned applications, systems, networks and/or databases, including but not limited to: Welfare Management System (WMS); Child Support Management System (CSMS); Automated State Support Enforcement and Tracking System (ASSETS); Benefits Issuance Control System (BICS); Cognos; Computer Output to Laser Disk (COLD) report system;

and/or the Commissioner’s Dashboard.

3. Data or information identifying an individual, particularly where such disclosure could result in an unwarranted invasion of personal privacy. Such data or information may include, but is not limited to: home addresses; telephone numbers; Social Security numbers; client identification numbers; payroll information; financial information;

health information; and/or, eligibility and benefit information;

4. Computer codes or other electronic or non-electronic data or information, the disclosure of which could jeopardize the compliance stature, security or confidentiality of OTDA’s information technology solutions, applications, systems, networks or data;

OTDA CONFIDENTIALITY/ NON-DISCLOSURE AGREEMENT

2 | P a g e

5. Non-final OTDA policy or deliberative data or information related to the official business of OTDA;

6. Data or information which is not otherwise required to be disclosed under the NYS Freedom of Information Law;

7. Any other material designated by OTDA as being “Confidential,” “Personal,” “Private” or otherwise “Sensitive.”

I acknowledge and agree that all Protected Information (oral, visual or written, including both paper and electronic) which I see or to which I have access shall be treated as strictly confidential and shall not be released, copied or otherwise re-disclosed, in whole or in part, unless expressly authorized by the New York State Office of Temporary and Disability Assistance (OTDA).

I understand and agree that access to and the use of Protected Information obtained in the performance of my duties shall be limited to purposes directly connected with such duties, unless otherwise provided in writing by OTDA. When access to such information or data also results in access to Protected Information or data beyond that which is necessary for the purpose for which access was granted, I agree to access only that Protected Information needed for the purpose for which access was given.

When I no longer require the use of or access to such Protected Information, whether because of termination of employment, reassignment of job duties or otherwise, I agree that I will not access or attempt to access any Protected Information, including, but not limited to any Protected Information in State systems or other sources, to which I have been given access. I will return any and all reports, notes, memoranda, notebooks, drawings, data and other Protected Information developed, received, compiled by or delivered to me in order to carry out my functions or which may be in my possession, regardless of the source of the Protected Information. Any Protected Information not returned will be catalogued, and thereafter securely scrubbed, shredded, or otherwise disposed of in accordance with New York State EISO policies [http://www.its.ny.gov/tables/technologypolicyindex].

I understand that federal and State law and regulation prohibit the release or disclosure of such Protected Information, in whole or part. I acknowledge and hereby agree that I will not copy, re-disclose or otherwise share Protected Information in whole or in part in any form to anyone unless I am expressly directed to do so by my supervisor and such disclosure complies with applicable federal and State law and regulation. I further understand that if I am unsure as to what information is confidential, I will immediately, and prior to any such access, use, or re-disclosure, consult with OTDA or my supervisor.

I will safeguard, and will not disclose to unauthorized parties, any user name and/or password that may be issued to me in furtherance of my access to the Protected Information unless authorized. I understand that my access to Protected Information may be revoked at any time if my responsibilities change, or for any other reason at the discretion and direction of OTDA, or my supervisor. Further, I will not facilitate access or disclosure of Protected Information to any unauthorized person or entity, whether by knowingly providing my user name and/or password or otherwise.

3 | P a g e

I will comply with all applicable Federal and State confidentiality, record security, compliance and retention laws, regulations, policies and procedures..

I will immediately report to my supervisor any activities by any individual or entity that I have reason to believe may compromise the availability, integrity, security or privacy of the Protected Information. I will immediately notify OTDA and my supervisor of any request for Protected Information that does not come from an individual directly involved in the project.

I agree not to attach or load any hardware or software to or into any State or Requestor equipment unless properly authorized, in writing, to do so by OTDA. I will use only my access rights to, and will access only those systems, directories, and Protected Information authorized for my use by

OTDA.

I will not use OTDA telecommunications, Internet, E-mail or other services or equipment for any illegal, disruptive, unethical or unprofessional activities, for personal gain, or for any purpose that could jeopardize the legitimate interests of the State or expose some or all Protected Information.

I agree not to knowingly take any actions that may intrude upon, disrupt or deny OTDA or Requestor services or the flow of any Protected Information.

I agree to store any Protected Information received in secure, locked containers or, where stored on a computer or other electronic media, in accordance with state and federal law and regulation, as well as OTDA’s and New York State Office of Information Technology Services’ (ITS) security policies that protects Protected Information from unauthorized disclosure.

I agree that no brochure, news/media/press release, public announcement, memorandum or other information of any kind regarding this Agreement or any Protected Information shall be disseminated in any way to the public, nor shall any presentation be given regarding this Agreement without the prior written approval of OTDA.

B. Access or Exposure to Information With Heightened Obligations:

I. Child Support Information

1. I acknowledge that, through attendance at a training program provided or approved by OTDA, I have been advised of the laws, regulations, policies, and rules governing use and disclosure of child support information, including federal information (as defined below) and agree to…