Attachment B - Offeror Privacy and Security Agreement.docx

Attachment B

OFFEROR AGREEMENT REGARDING

PRIVACY AND SECURITY OF PERSONAL AND FINANCIAL DATA

This Offeror Agreement Regarding Privacy and Security of Personal and Financial Data (“Agreement”) is made and entered into by the Bureau of Human Resources, State of South Dakota (“State”), as Sponsor and Plan Administrator for the South Dakota State Employee Health Plan (“Plan”) and ___________ business name __________________ (“Offeror”) having its principal office at business address dated as of date .

I. Premises for Agreement

A. The State desires to share certain Nonpublic Information (as defined herein) with the Offeror for the purpose of allowing the Offeror to respond to a request for proposal from the State and/or to provide certain health related welfare benefit plans to the State to be included in the Plan for the State’s employees.

B. The Offeror desires to submit a response to request for proposal to the State, and/or to assist the State with the acquisition and administration of health related welfare benefit plans for the State’s employees.

C. The Offeror and the State recognize that the submission of a response to request for proposal, and the acquisition and administration of non-heath welfare benefits plan for the State’s employees will require the sharing of Nonpublic Information of the State’s employees.

D. The Offeror and the State agree that the sharing of Nonpublic Information of the State’s employees gives rise to certain duties on the part of the Offeror to maintain the privacy and security of the Nonpublic Information.

E. The Offeror agrees to the terms and conditions of this Agreement as a condition of the State’s acceptance of the Offeror’s response to the State’s request for proposal and any contract with the State for the provision or administration of health related welfare benefits.

II. Definitions

A. “Adverse Event” means an observable occurrence where there is unauthorized use of system privileges, unauthorized access to State data, execution of malware, physical intrusions and electronic intrusions that may include network, applications, servers, workstations and social engineering of staff.

B. “Affiliate” means any person or entity that controls, is controlled by, or is under common control with the Offeror, including but not limited to a contractor, employee, subsidiary or corporate entity under the Offeror’s control.

C. “Authorized User” means any Affiliate that participates in the business of the Offeror and is authorized by the Offeror to access and use the Nonpublic Information. “Authorized User” also means any person designated by the State as an Authorized User for purposes of the Offeror’s services under this Agreement.

D. “Nonpublic Information” means information provided to the Offeror by the State concerning State employees, whether such information is transmitted or maintained in hard copy, electronic, digital or other form, that is not Publicly Available Information and which is:

a. Business or financial information of a State employee, the tampering with which, or unauthorized disclosure, access or use of which would cause or threaten to cause a material adverse impact upon a State employee;

b. Information concerning a State employee, which because of the name, number, personal mark or other identifier can be used to identify such employee or, which when used in combination with social security number, drivers’ license number, address, or date of birth would potentially permit access to the employee’s financial account; or

c. Personal information such as age, gender, date of birth, address, name of spouse, name of child, zip code or state of residence which, when used in combination with other data may permit access to the employee’s financial account, or be utilized to cause a material adverse impact upon the State employee.

E. “Publicly Available Information” means any information that a Offeror or Affiliate has a reasonable basis to believe is lawfully made to the general public from federal, state or local government records, widely distributed media or other public disclosures, such as “White Pages” or on-line locator services.

III. Privacy and Security

A. The Offeror represents and agrees that it has a privacy and cybersecurity program that is designed to protect the confidentiality, integrity and availability of the Nonpublic Information of the State’s employees to individuals and entities who are not Authorized Users.

B. The Offeror shall maintain Nonpublic Information in confidence to be used solely for purposes of the services the Offeror may or will provide to the State. The Offeror shall access, collect, maintain, process, handle, use, disclose and destroy all such Nonpublic Information. Nonpublic Information will be accessed by, used by, or disclosed only to Authorized Users as necessary and appropriate to work on matters for the State.

C. The Offeror may make Nonpublic Information available to a third party only upon advance written approval of the State, and the third party must agree in writing to the same protections, conditions and limitations contained herein.

D. The Offeror represents and agrees that it has implemented policies and procedures to protect the Nonpublic Information of the State’s employees and to limit access and use of such Nonpublic Information to the Offeror and its Authorized Users.

E. The Offeror represents and agrees that its privacy and cybersecurity program policies and procedures addresses, at a minimum, the following:

a. information security;

b. access controls (including multi-factor authentication of Authorized User) and identity management;

c. systems and network security;

d. physical security and environmental controls;

e. encryption protocols for the transmission of Nonpublic Information;

f. data privacy;

g. risk assessment; and

h. incidents (breaches of security) alert, response and reporting mechanisms to the State for breaches and unauthorized uses and disclosures of Nonpublic Information.

F. The Offeror shall supply the State with the contact information of the person who is responsible for overseeing and implementing the Offeror’s cybersecurity program.

I. The Offeror shall notify the state contact within one (1) day if the Offeror becomes aware that an Adverse Event has occurred. The State can require a risk assessment of the Offeror with the State mandating the methodology to be used as well as the scope. At the State’s discretion a risk assessment may be performed by a third party at the Offeror’s expense.

IV. Return of Documents and Information

A. The Offeror shall return all Nonpublic Information concerning the States’ employees to the State, in the form directed by the State, within fifteen (15) business days of the State’s request.

B. Upon the State’s request and direction, the Offeror shall destroy all Nonpublic Information concerning the State’s employees.

V. Miscellaneous

A. Remedies of the State. In event of a breach of Offeror’s cybersecurity program, or an unauthorized use or disclosure of Nonpublic Information of one or more of the State’s employees, the Offeror agrees it shall be liable to the State for monetary damages suffered by the State’s employee(s), including but not limited to the costs associated with necessary remedial measures, which may include, assisting the impacted employee(s) to acquire new identification documents; credit counseling and repair services; correction communications to credit reporting agencies, banks or financial institutions, or other reasonably necessary remedial measures.

B. Venue for Enforcement of this Agreement. This Agreement may be enforced in litigation only in the Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota.

C. Construction of the Agreement. This Agreement shall be construed under the laws of the State of South Dakota.

D. Controlling Agreement. This Agreement supersedes and replaces any existing agreement, written or otherwise, entered into between the Parties relating to the subject matter hereof.

E. Partial Invalidity. In the event that any provision of this Agreement shall be held invalid or unenforceable for any reason, such invalidity or unenforceability shall attach only to the particular aspect of such provision found invalid or unenforceable and shall not affect any other provision of this Agreement. To the fullest extent permitted by law, this Agreement shall be construed as if the scope or duration of such provision had been more narrowly drafted so as not to be invalid or unenforceable.

F. Modification of Agreement. This Agreement may be modified or waived only by a separate writing by the duly authorized officers of the Parties expressly modifying or waiving this Agreement.

G. No Waiver of Agreement. No failure or delay by the State in exercising any right, power or privilege hereunder will operate will operate as a waiver thereof, nor will any single or partial exercise thereof preclude any other or further exercise thereof or the exercise of any other right, power or privilege hereunder.

H. Term. This Agreement shall become effective as of the date entered into above as stated on page 1 of this Agreement and shall terminated on June 30, 2021.

In Witness Whereof, the parties signify their agreement by the signatures affixed below.

.STATE OF SOUTH DAKOTA OFFEROR

Date: Date:

Legal

2 Revised 10/27/2025