Attachment_3_-__Appendix_J_-_Data_Sharing_Security.docx

Appendix J: Privacy and Data Security [name of Vendor/Provider] [contract name / program] [begin term date – end term date] SFHSA Data Sharing & Security Page 5 of 28 July 11, 2023 Table of Contents

SFHSA Data Sharing Agreement Page 5 of 28 July 11, 2023 Recitals WHEREAS, the Parties wish to state the terms and conditions under which SFHSA will provide Data Recipient with access to City Data; and WHEREAS, Data Recipient represents and warrants that it has a legitimate need to access City Data and will limit use of such information only to the extent minimally necessary to accomplish the intended purpose, as detailed in this Agreement, the Data Set Request documents, Account Provisioning Request documents and/or Account Provisioning Terms of Use, referenced herein; and WHEREAS, until SFHSA and Data Recipient enter into a subsequent access agreement that supersedes this Agreement, Data Recipient and each Data User agrees to be bound by all of the terms and conditions set forth herein and further agrees that, for the purpose described above, the terms and conditions of this Agreement constitute the sole Agreement between the Parties regarding City Data Set sharing and/or System(s) access;

Now, THEREFORE, Data Recipient agrees to be bound by the following terms:

1. Definitions Terms used and not defined in this Appendix shall have the meanings assigned to such terms in the Agreement. The following definitions apply to this Appendix:

“Account Provisioning Request” means a request for account provisioning (also known as system access) made to SFHSA IT by using their required form(s) and process. The Account Provisioning Request form is available from the HSA SPOC as referenced in Article 2, Section 12. The terms of use for access to City system accounts are located in Attachment 3. Comment by Leone, Elizabeth (HSA): Added this sentence. Please correct the email address of where vendors should be getting the APR form... Comment by Chiang, Vivian (HSA): The email address is incorrect; please update the sentence to say something like - The Account Provisioning Request form is available form the HSA SPOC referenced in Item 2.12. Comment by Leone, Elizabeth (HSA): Updated... Comment by Leone, Elizabeth (HSA): Added this sentence to reference Attachment 3 “Agreement” means Agreement (ID [NUMBER]) into which this Appendix [LETTER] is specifically incorporated by reference as provided herein.

“Appendix [LETTER]” means the terms and conditions set forth, including all attached Data Set Request(s) and/or Account Provisioning Terms of Use and all applicable City Ordinances and mandatory City requirements which are specifically incorporated into this Appendix by reference as provided herein.

“Breach” means the unauthorized acquisition, access, use, or disclosure of City Data in a manner which compromises the security, confidentiality, or integrity of the information.

“City Data” means all data provided to Data Recipient under this Agreement, whether such data is individual or aggregated.

“Data Recipient” means [RECIPIENT’S NAME AND ADDRESS] including but not limited to Data Recipient’s employees, agents, and approved subcontractor(s), if any, to whom the SFHSA provides City Data.

“Data Set” means Data in a file of any format provided by SFHSA to the Data Recipient, and described in the required Data Set Request.

“Data Set Request” means a request for a Data Set made to SFHSA IT by using their required form(s) and process; included in this Agreement as Attachment 1. Comment by Leone, Elizabeth (HSA): Added reference to Attachment 1 “Data User” means each individual, including employees, supervised by Data Recipient that Data Recipient authorizes to use a City Data Set and/or System in accordance with this Agreement and for whom Data Recipient assumes full responsibility.

“Single Point of Contact” and “SPOC” means an SFHSA staff member assigned to act on behalf of Data Recipient in an administrator or managerial role, and tasked with data sharing responsibilities. By way of example, the SPOC may submit requests for data from within City System(s) on behalf of Data Recipient, or the SPOC may take action to revise or remove account permissions associated with a specific Data User. Comment by Lopez, Valerie (CAT): Bold.

“System(s)” means a program, portal, or other method, typically requiring authentication of each Data User, by which Data Recipient and each Data User directly accesses City Data in a repository, such as a database or other method of electronic or digitized data storage.

City Data Sharing Purpose.

SFHSA is a public welfare agency committed to the public good, which desires to understand and better serve the citizens of the City and County of San Francisco, California; and VENDOR is a provider assisting SFHSA in the administration of benefits consistent with California Welfare and Institutions Code section 10850(b) [OR] [NOTE RE TEMPLATE: PRIVACY OFFICE WILL CHOOSE ONE OF THE FOLLOWING PHRASES] [FOR ADMINISTRATION OF AN ESSS PROGRAM] [FOR ADMINISTRATION OF AN FCS PROGRAM] TBD [OR] [FOR ADMINISTRATION OF A DAS PROGRAM] TBD.

Legal Authority.

PRIVACY OFFICE WILL CHOOSE THE APPROPRIATE CODE TO INSERT HERE

Data Sharing Limits.

This Agreement supersedes all pre-existing data access agreements, if any, for the intended purpose, including access and/or sharing not detailed in writing. SFHSA reserves the right to revoke, limit, or modify any and all access agreements as deemed appropriate by SFHSA acting in its sole discretion. Data Recipient’s access under this Appendix is strictly limited to access authorized under the attached Data Set Request(s) and/or Account Provisioning Terms of Use. Comment by Leone, Elizabeth (HSA): Updated the title of document to comport with the rest of the appendix...

As Is Data Sharing.

The City provides Data Recipient with shared City Data DELETE IF THERE IS NO ACCOUNT PROVISIONING / SYSTEMS ACCESS: [and System(s) access] on an "as is" basis with no guarantee as to usefulness, uptime, or accessibility. To the fullest extent permissible by applicable law, the City disclaims all warranties, express or implied, including, without limitation, implied warranties of merchantability, fitness for a particular purpose, title and non-infringement.

Safeguards.

Data Recipient shall safeguard the confidentiality of all shared City Data at all times.

No Re-Disclosure or Reporting.

Data Recipient may not re-disclose City Data or otherwise prepare reports, summaries, or other material (in electronic or hard-copy format) regarding or containing City Data for transmission to any other requesting individuals, agencies, or organizations without prior written City approval.

Subcontracting.

Data Recipient shall show that any and all subcontractors given access to City Data under this Agreement shall use current industry standard(s) with respect to City Data and the terms of this Appendix. If the City approves a subcontract, Data Recipient remains fully responsible for its subcontractor(s) throughout the term and/or after expiration of this Agreement. All Subcontracts must incorporate the material terms of this Appendix. To the extent that any subcontractor would have access to shared City Data, each such subcontractor’s access must be limited and subject to the same governing terms to the same extent as Data Recipient’s access.

Liability for Misuse or Mishandling of Data.

Data Recipient shall comply with all applicable local, state, and federal laws regarding the transmission, storage and protection of all City Data. Data Recipient agrees that any failure of Data Recipient to comply with the requirements of federal and/or state and/or local privacy laws shall be a material breach of the Agreement. In the event that City pays a regulatory fine, and/or is assessed civil penalties or damages through private rights of action, based on an impermissible use or Breach of City Data attributable to the actions of Data Recipient, Data Recipient shall indemnify City for the amount of such fine or penalties or damages, including costs of notification. For clarity, Data Recipient, not the City, is responsible for the costs of breach remediation to the extent Data Recipient is responsible for impermissible use or Breach.

Access Requests.

Access to SFHSA Data requires submission and approval of either a Data Set Request or both a Data Set Request and an Account Provisioning Request. Access to each System or Data Set may require a separate Account Provisioning Request or Data Set Request. Multiple Account Provisioning Requests and / or Data Set Requests may be governed by this Agreement. Account Provisioning Requests or Data Set Requests submitted under this Agreement and approved by SFHSA are incorporated herein. Provisions of this Agreement specific to either System(s) access or Data Set access apply when such access has been granted.

Data Description.

The City Data to be shared by SFHSA to Data Recipient as described in the Data Set Request(s) and/or Account Provisioning Terms of Use.

SFHSA Single Point of Contact (SPOC).

Before Data Set and/or System(s) access is granted, SFHSA must appoint a primary and alternate SFHSA SPOC responsible for access tasks, including but not limited to the following:

Completing and obtaining City approval of the Data Set Request(s) and/or Account Provisioning Request(s);

Communicating with the SFHSA IT Service Desk or other SFHSA data administrator for provisioning and deprovisioning Data Users needing creation of Data Set files and/or System(s) access;

Individual Data Users are not authorized to contact the SFHSA IT Service Desk, and the SFHSA IT Service Desk reserves the right to decline any call placed b y other than the SFHSA SPOC;

Providing Data User(s) details to SFHSA IT or other SFHSA data administrator;

Receiving and arranging SFHSA review of Data Recipient’s work product when required by this Agreement including this Appendix;

Ensuring that Data User(s) complete any SFHSA privacy and data security trainings annually, if required; and Ensuring that Data User(s) understand and execute SFHSA’s data access confidentiality agreement, if required.

SPOC Contact Info.

SFHSA appoints the following SPOC and alternate:

Data Security Security of PII.

Data Recipient is solely responsible for maintaining data security policies and procedures consistent with those of the City that will adequately safeguard all shared City Data and Systems. Upon request, Data Recipient will provide such security policies and procedures to the City.

Data Recipient shall maintain computers and other information systems and technology infrastructure that it uses for shared City Data in a secure manner.

The City acting at its sole discretion may audit Data Recipient and Data Recipient’s Data Users at any time. If an audit reveals an irregularity or security issue, the City may take corrective action including but not limited to termination of such Data Recipient’s and/or Data User’s access to the System(s) permanently or until the City determines that all irregularities have been satisfactorily cured. Data Recipient and each Data User understands that the City may create and review an audit trail for each Data User, including but not limited to, noting each Data User’s ID(s), the information accessed, and/or the date accessed. Data Recipient and each Data User understands that any inappropriate access or use of information, as determined by the City, may result in the temporary and/or permanent termination of Data Recipient’s or such Data User’s access to the System(s). Data Recipient remains liable for all inappropriate System(s) access, misuse and/or breach of information, whether in electronic or hard-copy form. Such examination will occur at a mutually acceptable time agreed upon by the parties in accordance with such laws and regulations, but no later than ten (10) business days after Data Recipient’s receipt of the request.

In addition to all other remedies in this Agreement and in law for a Breach of City Data, failure to properly secure City Data may result in termination of access to such City Data.

Data Security and SFHSA Data.

The Data Recipient shall provide security for its networks and all internet connections consistent with industry best practices, and will promptly install all patches, fixes, upgrades, updates and new versions of any security software it employs.

For information disclosed in electronic form, Data Recipient agrees that appropriate safeguards include electronic barriers (e.g., "firewalls", Transport Layer Security (TLS), Secure Socket Layer [SSL] encryption, or most current industry standard encryption, intrusion prevention/detection or similar barriers).

Data Privacy and Information Security Program.

Without limiting Data Recipient’s obligation of confidentiality as further described herein, Data Recipient shall be responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to: (i) ensure the security, confidentiality, and integrity of City Data; (ii) protect against any anticipated threats or hazards to the security, confidentiality, or integrity of City Data; (iii) protect against unauthorized disclosure, access to, or use of City Data; (iv) ensure the proper disposal of City Data; and, (v) ensure that all of Data Recipient’s employees, agents, and subcontractors, if any, comply with all of the foregoing. In no case shall the safeguards of the Data Recipient’s data privacy and information security program be less stringent than the safeguards and standards recommended by the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Notification of Legal Requests.

Data Recipient shall immediately notify City upon receipt of any legal requests related to City’s Data under this Agreement, or which in any way might reasonably require access to City’s Data, and in no event later than 48 hours after it receives the request. Data Recipient shall not respond to legal requests related to City without first notifying City. Data Recipient shall retain and preserve City Data in accordance with City’s instruction and requests, including without limitation any retention schedules and/or litigation hold orders provided by the City to Data Recipient, independent of where City Data is stored.

Minimum Use.

Access to City Data will be restricted to authorized personnel for the express purpose of performing duties in connection with the intended use of the Data under this Agreement including this Appendix. Data Recipient and its Data Users shall request and access City Data only to the minimum extent necessary to accomplish the intended use of the Data under this Agreement including this Appendix. Disclosures, if allowed by law and this Agreement, must disclose the minimum amount of data possible. All persons who have access to the Data will be advised of the confidentiality requirements detailed in this Agreement including this Appendix.

Supervision of Data.

City Data in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, or desk. Locked offices are not considered secure unless they are inaccessible to staff who are not Data Users (including janitorial staff). Unattended means that information is not being observed by a Data User authorized to access the information. City Data in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes or other commercial modes of travel.

No Faxing/Mailing.

City Data may not be faxed or mailed.

Device Encryption.

All electronic files that contain City Data must be encrypted when stored on a device or media that is reasonably portable, including desktop and laptop workstations and removable or removed media (USB drives, CD/DVD, magnetic tape, etc., as well as hard drives that have been removed from a computer). Encryption must meet FIPS 140-2 security requirements for cryptographic modules. Decryption passwords must not be carried or stored along with the device containing the encrypted data.

Server Security.

Servers containing unencrypted City Data must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review.

Notification of Compromised Password.

In the event that a password assigned to or created by a Data User and used to access City Data is compromised or disclosed to a person other than the Data User, Data Recipient shall upon learning of the compromised password immediately notify SFHSA at HSAPrivacyOffice@sfgov.org. Data Recipient is liable for any such misuse. Data Recipient’s failure to monitor each Data User’s ID and/or password use shall provide grounds for SFHSA to terminate and/or limit Data Recipient’s access to SFHSA Data.

Antivirus software.

All workstations, laptops and other systems that process and/or store City Data must install and actively use a comprehensive anti-virus software solution with automatic updates scheduled at least daily.

Patch Management.

All workstations, laptops and other systems that process and/or store City Data must have operating system and application security patches applied, with system reboot if necessary. There must be a documented patch management process that determines installation timeframe based on risk assessment and vendor recommendations.

System Timeout.

All workstations, laptops and other systems that process and/or store City Data must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity.

Warning Banners.

All systems containing City Data must display a warning banner each time a user attempts access, stating that data is confidential, systems are logged, and system use is for business purposes only. Users must be directed to log off the system if they do not agree with these requirements.

Transmission encryption.

All data transmissions of City Data outside the Data Recipient’s secure internal network must be encrypted using a current industry standard algorithm. This requirement may be satisfied either by utilizing encrypted transfer protocols such as HTTPS or SSH, or by encrypting data files prior to transfer. This requirement pertains to any type of City Data in motion such as website access, file transfer, and e-mail.

Intrusion Detection.

All systems involved in accessing, holding, transporting, and protecting City Data that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

Disaster Recovery.

The Data Recipient must establish a documented plan to protect the security of electronic City Data in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this agreement for more than 24 hours.

International Transfers City Data shall not be transferred, transmitted, or transported outside the borders or legal jurisdiction of the United States of America.

RESERVE (do not delete title, but remove subsections below) if sections below do not apply. System(s) Access Data Security Requirement for Systems Access Data Security This Article applies if and when an Account Provisioning Request is completed and approved, as provided for in Section 3.9. The Sections of this Article do not apply unless and until an Account Provisioning Request is approved. The terms of use for access to City system accounts are located in Attachment 3. Comment by Leone, Elizabeth (HSA): Added this sentence to reference Attachment 3 No Technical or Administrative Support Except as provided herein, the City will provide no technical or administrative support to Data Recipient or Data Recipient’s Data Users for System(s) access.

Primary and Secondary Data Recipient Site Administrator.

Before System(s) access is granted, Data Recipient must appoint a primary and alternate Data Recipient Site Administrator responsible for System(s) access tasks, including but not limited to the following:

Communicating with the SFHSA IT Service Desk;

Providing Data Recipient’s Data User(s) details to the City;

Ensuring that Data Recipient’s Data User(s) complete required SFHSA trainings annually;

Ensuring that Data Recipient’s Data User(s) understand and execute SFHSA’s data access confidentiality agreement; and Provisioning and deprovisioning Data Recipient’s Data Users as detailed herein.

SFHSA IT Service Desk.

For new provisioning requests, only Data Recipient Site Administrators are authorized to contact the SFHSA IT Service Desk. The City reserves the right to decline any call placed by individuals other than the Data Recipient Site Administrator. Individual Data Recipient’s Data Users are not authorized to contact the SFHSA IT Service Desk.

Deprovisioning Schedule.

Data Recipient, through the Data Recipient Site Administrator, has sole responsibility to deprovision Data Users from the System(s) as appropriate on an ongoing basis. Data Recipient must immediately deprovision a Data User upon any event ending that Data User’s need to access the System(s), including job duty change and/or termination. Data Recipient remains liable for the conduct of Data Users until deprovisioned. When deprovisioning employees, Data Recipient must maintain evidence that the SFHSA IT Service Desk was notified.

Role Based Access.

Each Data User’s access to the System(s) will be role-based and access is limited to that necessary for the purposes specified in this Agreement. The City will assign Data User roles upon provisioning and reserves the right to deny, revoke, limit, or modify Data User’s access acting in its sole discretion.

Training Requirements.

Before System(s) access is granted, and annually thereafter, each Data User must complete privacy and security training. Data Recipient must maintain written records evidencing such annual training for each Data User and provide copies upon request to the City. For questions about privacy and security training, contact the SFHSA SPOC.

Before Data User first access to System(s), system-specific training must be completed. For training information, Data Recipient Site Administrator may contact the SFHSA IT Service Desk.

Data User Account Provisioning Request Form.

Before System(s) access is granted, each Data User must complete SFHSA’s Account Provisioning Request form. This form must be renewed annually and is available from the HSA SPOC as referenced in Article 2, Section 12. See Attachment 3 for terms of use. Comment by Leone, Elizabeth (HSA): Added this sentence. Please correct the email address of where vendors should be getting the APR form... Comment by Chiang, Vivian (HSA): The email address is incorrect; please update the sentence to say something like - The Account Provisioning Request form is available form the HSA SPOC referenced in Item 2.12. Comment by Leone, Elizabeth (HSA): Updated...

Acceptable Use.

Data Users may use system access solely to perform functions within the scope of work for this Agreement.

Systems Access Corrective Action.

Data Recipient shall take corrective action, including but not limited to termination and/or suspension of any System(s) access by any Data User who acts in violation of this Agreement and/or applicable regulatory requirements.

System Credentials.

Each individual Data User will be assigned or create a User ID and password for the system(s) or application(s) they are authorized to access. Data Recipient and each Data User shall protect the confidentiality of User IDs and passwords and shall not divulge them to any other person(s). Data Users shall not share credentials nor allow their use, or access to City systems or data permitted by their use, by any other individual. Data Recipient is responsible for the security of the User IDs and passwords issued to or created by Data Recipient’s Data Users and is liable for any misuse.

Multi Factor Authentication.

Data Recipient and each Data User must use multi-factor authentication as directed by the City to access the System(s).

Qualified Personnel.

Data Recipient shall allow only qualified personnel under Data Recipient’s direct supervision to act as Data Users with access to the System(s).

Remote Access.

If given remote access to the internal SFHSA network (such as by means of Remote Desktop), Data Recipient and each Data User must perform work in such a way that City Data is not transmitted or stored outside the SFHSA computing environment.

Embedded Network Access.

If given access to the internal SFHSA network by means of embedded network access (such as an Active Directory account), Data Recipient and each Data User must:

Use only City-issued IT equipment when working with City Data or performing duties related to this Agreement; and Perform work in such a way that City Data is not transmitted or stored outside the SFHSA computing environment.

City-issued IT Equipment.

City-issued workstations and laptops are to be used only for the purposes described in this Agreement and only by authorized Data Users.

City-issued IT equipment shall not be transported outside the borders or legal jurisdiction of the United States of America.

Data Recipient and each Data User must use reasonable measures to ensure that City IT equipment is not lost, stolen, or used for unauthorized access, including:

Laptop computers and other portable devices shall not be left unattended for any amount of time outside of secure locations such as HSA offices or the user’s private residence.

Laptop computers, desktop computers, and other reasonably portable devices shall be physically secured in a locked room or cabinet, and / or affixed to furniture with a cable lock or similar control, whenever not in use.

City-issued IT equipment shall not be left unattended in any vehicle for any amount of time.

City-issued IT equipment shall not be checked in baggage on commercial airplanes or other commercial modes of travel. If traveling with City-issued IT equipment, the equipment must be under the direct control or observation of the assigned user at all times.

Liability for Use of Equipment City shall not be liable for any damage to persons or property as a result of the use, misuse or failure of any equipment used by Data Recipient, or any of its subcontractors, or by any of their employees, even though such equipment is furnished, rented or loaned by City.

Termination or Expiration All Sections of this Appendix [LETTER] shall survive termination or expiration of this Agreement.

Data Breach Data Breach Notification.

The Data Recipient shall notify the SFHSA immediately by email at HSAPrivacyOffice@sfgov.org upon the discovery of a breach (as herein). For purposes of this Section, breaches and security incidents shall be treated as discovered by Data Recipient as of the first day on which such breach or security incident is known to the Data Recipient, or, by exercising reasonable diligence would have been known to the Data Recipient. Data Recipient shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee or agent of the Data Recipient.

In the event that Data Recipient experiences a data breach that results in a confirmed unauthorized disclosure that compromises the security, confidentiality, or integrity of City Data, Data Recipient shall, as applicable:

Notify City immediately following discovery, but no later than forty-eight (48) hours, of such confirmation. Data Recipient’s report shall identify:

the nature of the event, use or disclosure;

the information accessed, used or disclosed;

the person(s) who accessed, used and disclosed and/or received protected information (if known);

what Data Recipient has done or will do to mitigate any deleterious effect of the unauthorized access, use or disclosure, and what corrective action Data Recipient has taken or will take to prevent future unauthorized access, use or disclosure.

Coordinate with the City in its breach response activities including without limitation:

Immediately preserve any potential forensic evidence relating to the breach, and remedy the breach as quickly as circumstances permit;

Promptly (within 5 business days) designate a contact person to whom the City will direct inquiries, and who will communicate Data Recipient responses to City inquiries;

As rapidly as circumstances permit, apply appropriate resources to remedy the breach condition, investigate, document, restore City service(s) as directed by the City, and undertake appropriate response activities;

Provide status reports to the City on Breach response activities, either on a daily basis or a frequency approved by the City;

Make all reasonable efforts to assist and cooperate with the City in its Data Breach response efforts;

Ensure that knowledgeable Data Recipient staff are available on short notice, if needed, to participate in City-initiated meetings and/or conference calls regarding the Data Breach; and Cooperate with City in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials as it relates to City’s Data only, required to comply with applicable law or as otherwise required by City.

Perform or take any other actions required to comply with applicable law as a result of the occurrence;

Provide to City a detailed plan within ten (10) calendar days of the occurrence describing the measures Data Recipient will undertake to prevent a future occurrence.

Assist the City upon request and/or as directed in providing notice and/or monitoring to affected individuals, in compliance with applicable law.

If notification to individuals whose information was breached is required under state or federal law, and regardless of whether Data Recipient is considered only a custodian and/or non-owner of the City Data, Data Recipient shall, at its sole expense, and at the sole election of City, either:

make notification to the individuals affected by the breach (including substitute notification), pursuant to the content and timeliness provisions of such applicable state or federal breach notice laws. Data Recipient shall inform the City of the time, manner and content of any such notifications, prior to the transmission of such notifications to the individuals; or cooperate with and assist City in its notification (including substitute notification) to the individuals affected by the breach.

If notification to individuals is required, and regardless of whether Data Recipient is considered only a custodian and/or non-owner of the City Data, Data Recipient shall, at its sole expense, and at the sole election of City, either:

electronically submit a single sample copy of the security breach notification as required to the state or federal entity and inform the City of the time, manner and content of any such submissions, prior to the transmission of such submissions to the Attorney General; or cooperate with and assist City in its submission of a sample copy of the notification to the Attorney General.

Breach Corrective Action.

Data Recipient shall take prompt corrective action to mitigate any risks or damages involved with the breach or security incident and to protect the operating environment and any action pertaining to a breach required by applicable federal and state laws.

Media Communications.

City shall conduct all media communications related to such Data Breach, unless in its sole discretion, City directs Data Recipient to do so.

Disclosure Restrictions.

In the event of a Federal or other entity restriction placed upon the timing of Data Recipient’s notification to City of a Data Breach or of loss of City Data, Data Recipient shall immediately disclose such restriction to City and/or require that the entity that placed such restriction immediately notify City.

RESERVE (do not delete title, but remove the subsections below) if sections below do not apply. Additional Confidentiality Documents RESERVE IF THERE IS NO COURT ORDERS REQUIRED. Court Orders.

Some City Data may be shared only by Court Order. Any required Court Orders shall be considered a part of and incorporated into this Agreement, governed by all its terms, and included in this Agreement as Attachment 2. Comment by Leone, Elizabeth (HSA): Added this reference to Attachment 2 RESERVE IF DATA IS NOT SUBJECT TO A BAA SIGNED BY SFHSA. Privacy Office will confirm if BAA is needed. Protected Health Information (PHI).

The parties acknowledge that for access to PHI or to System(s) and Data Sets subject to terms of Business Associate Agreements signed by SFHSA, SFHSA may require Data Recipient to sign a Business Associate Agreement requiring compliance with the HIPAA Privacy Rule governing the access, transmission, and storage of health information and the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”). Data Recipient, Data Users, all agents and employees of Data Recipient, and any subcontractor shall comply with all federal and state laws regarding the transmission, storage and protection of any and all PHI disclosed to Data Recipient by SFHSA in the performance of this Agreement. Data Recipient agrees that any failure of Data Recipient to comply with the requirements of federal and/or state and/or local privacy laws shall be a material breach of the Contract.

Use of City Data in Materials and Publication De-identification.

All materials produced by Data Recipient will be de-identified and contain sufficient protections to ensure SFHSA client anonymity and to adhere to the mandates for confidentiality as required by all applicable law, court orders, and this Agreement including this Appendix I. No materials will be disseminated that describe or identify specific individuals, families, or households. No names, street addresses or other information that could be used to identify a particular individual, family, or household will be disseminated nor will Data Recipient cross-reference the Data with individually-identifiable records from any other data set without authorization from SFHSA to do so.

Publication.

Any publication resulting from the Data must indicate that the Data was provided by SFHSA and will include a disclaimer to the effect that published material does not necessarily reflect the views of SFHSA. SFHSA reserves the right to review and comment on any document or data set completed as a result of the sharing of information for compliance with this Agreement before release to any entity. The period of SFHSA review will be 30 days from SFHSA receipt of the work product.

General Provisions Data Breach Notice.

Data breaches must be reported as specified in Article 7 of this Appendix.

DELETE THIS ARTICLE IF A CRA WAS NOT REQUIRED. Reports

11.1 Cybersecurity Risk Assessment.

As part of HSA's evaluation process, SFHSA may engage in Cybersecurity Risk Assessment (CRA). CRA may be performed for each entity accessing SFHSA's networks and systems or receiving City Data. To conduct a CRA, SFHSA may collect a Cyber Risk Assessment Questionnaire. The report will be evaluated by the SFHSA to identify existing or potential cyber risks to SFHSA. Should such risks be identified, SFHSA may afford a potential Data Recipient an opportunity to cure such risk within a period of time deemed reasonable to SFHSA. Such remediation and continuing compliance shall be subject to SFHSA's on-going review and audit through industry-standard methodologies, including but not limited to, on-site visits, review of the entities' cybersecurity program, information security policies, and/or vulnerability assessments.

Attachment 1: Data Set Request form Attachment 2: Court Order (as needed) Attachment 3: Account Provisioning Request Terms of Use (as needed)