Attachment 2 Contract Adden Security of Pers Info.pdf

ATTACHMENT ___

CONTRACT ADDENDUM FOR

SECURITY OF PERSONAL INFORMATION

This Contract Addendum is effective as of the ______, by and between the

Judiciary, State of Hawaii (JUDICIARY), and ___________________.

(CONTRACTOR), whose address is _______________________________________.

WHEREAS, JUDICIARY and CONTRACTOR executed an Agreement dated

_______ (hereinafter “Agreement”) for _____________________________ services;

WHEREAS, during the course of performing services for JUDICIARY, CONTRACTOR may have access to individual personal information; and

WHEREAS, pursuant to 2008 Haw. Sess. Laws, Special Session Act 10, contracts that require contractors to access personal information shall include provisions to protect the use and disclosure of personal information.

NOW THEREFORE, JUDICIARY and CONTRACTOR agree to the following requirements:

1. ”Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: (A) social security number; (B) driver’s license number or identification card number; or (3) account number, credit or debit card number, access code, or password that would permit access to and individual’s financial account.

2. CONTRACTOR shall implement administrative, physical, and technological safeguards that reasonably and appropriately protect personal information from unauthorized use or access to such data. Personal information shall be maintained in a secured environment with reasonable security controls, including but not limited to, firewalls, antivirus software, intrusion detection systems, penetration testing, and security patches and upgrades.

3. Any personal information that is electronically transmitted between the

JUDICIARY and CONTRACTOR shall be protected by encryption under the

Advanced Encryption Standard (AES), FIPS Publication 197, or the most recent acceptable standard that is available.

4. Access to personal information shall be password protected and shall be strictly limited to individuals with a legitimate business need to access the data to perform functions and services required under the Agreement. All individuals given access to personal information shall have been subject to and have passed a criminal history background check that has been designed to reasonably assure the individual’s trustworthiness and mitigate the risk of the individual improperly accessing, using, transmitting and/or disclosing personal information.

5. CONTRACTOR shall ensure that all of its employees who are given access to personal information sign an agreement acknowledging that: (A) the personal information collected, used, or maintained by JUDICIARY is confidential; (B) access to the personal information is restricted to the minimum necessary, and

(C) use of the personal information is restricted to uses consistent with the services subject to the Agreement.

6. CONTRACTOR shall provide initial and periodic refresher training on security awareness to all employees who have access to personal information, and have procedures for taking appropriate corrective action in the event that security of the personal information is breached.

7. CONTRACTOR shall also conduct periodic security risk assessments of its security procedures to ensure that they are being followed and continue to be adequate to reasonably ensure the security of personal information. Results of such assessments shall be made available to Judiciary upon specific request.

CONTRACTOR shall identify the steps for any necessary remediation of unreasonable security vulnerabilities found and provide a timetable to complete the remediation.

8. CONTRACTOR shall restrict the copying, downloading, transmission, or transferring of personal information to other computers, electronic devices, media or any other destination by any means except as necessary to perform the functions and services required under the Agreement. CONTRACTOR shall not copy, download, transmit, or transfer personal information for any purpose, other than what is necessary to perform its contracted services, without the prior consent of the JUDICIARY. Any personal information in electronic form, other than that stored on primary equipment required for the contracted services, that is copied, downloaded, transmitted, or transferred shall be encrypted as provided in paragraph 3 above.

9. CONTRACTOR shall ensure that any agent, including a subcontractor who is given access to any personal information, understands and agrees to the same terms and conditions set forth in this Addendum. The JUDICIARY shall be notified of all subcontractors given access to personal information.

10. Hawaii Revised Statutes chapter 487N requires businesses and government agencies that maintain and collect personal information to provide notice of any security breach of that information. In the event of any security breach of personal information, CONTRACTOR agrees to notify JUDICIARY within twenty-four (24) hours of discovery of the breach. CONTRACTOR further agrees to comply with all notification actions and/or assist JUDICIARY with all notification actions required by law and by JUDICIARY policy.

11. CONTRACTOR shall not use or retain personal information for any purpose other than to perform services required under the Agreement.

12. Personal information obtained by CONTRACTOR as a result of this Agreement shall be properly disposed of when the Agreement expires or is terminated.

CONTRACTOR shall comply with Hawaii Revised Statutes chapter 487R, which requires businesses and government agencies that maintain and possess personal information to take reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal.

13. CONTRACTOR shall maintain a record of all disclosures of personal information.

IN WITNESS WHEREOF, the parties execute this Contract Addendum for Security of

Personal Information by their signatures, on the dates below.

THE JUDICIARY, STATE OF HAWAII

By:_____________________________ Rodney A Maile

Administrative Director of the Courts

Date:___________________________

CONTRACTOR

By: ___________________________

Date: _________________________

Approved as to Form:

Judiciary Staff Attorney