Attachment D Data Sharing Agreement.pdf
PDF 153 KB Posted
- Attached to
- Consulting and Actuarial Services State and local contract opportunity
- Solicitation number
- S000000450
- Issued by
- Arkansas
About this file
The document is an Arkansas Data Sharing Agreement (ADSA) designed to facilitate data disclosure between Departments of the State of Arkansas. The agreement outlines a framework for sharing data among state departments, with specific provisions for how data can be accessed, used, and protected. The ADSA establishes comprehensive guidelines for both the Disclosing Department (the department sharing data) and the Receiving Department (the department obtaining data), ensuring that data exchanges are conducted securely and in compliance with applicable laws and regulations.
Key provisions include strict requirements for data protection, including the use of secure file transfer protocols, encryption, and maintaining confidentiality. The agreement mandates that only Authorized Users can access the data, and they must complete privacy and security training. Both departments have specific responsibilities: the Disclosing Department must ensure it has the legal authority to share data, while the Receiving Department must protect the data from unauthorized use. The agreement allows for termination with 30 days' notice and does not prevent departments from sharing data through independent agreements. An incident reporting mechanism is also established, requiring any data breaches to be reported within 24 hours to the Disclosing Department and the Cyber Insurance Program.
View the file
Other files for this state and local contract opportunity
| File | Type | Posted |
|---|---|---|
| S000000450 Contract and Grant Disclosure.pdf | ||
| S000000450 Consulting and Actuarial Services.pdf | ||
| Attachment A Act 956.pdf | ||
| S000000450 Official Solicitation Price Sheet~1.xlsx | XLSX spreadsheet | |
| S000000450 Services Contract SRV-1 Sample.pdf | ||
| Attachment B Business Associate Agreement.pdf | ||
| Attachment C Non-Disclosure Agreement.pdf | ||
| S000000450 Technical Proposal Packet.docx | DOCX document |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ARKANSAS DATA SHARING AGREEMENT
The purpose of this Arkansas Data Sharing Agreement (ADSA) is to facilitate the disclosure of Data between Departments of the State of Arkansas and to outline the rights and obligations with respect to the Data being shared.
ARTICLE 1. LEGAL AUTHORITY AND DATA OWNERSHIP
Each Department entering into this ADSA agrees that sharing of Data does not constitute a transfer in ownership from the originating Department. Additionally, any sharing of Data is not contrary to and does not change any responsibility of any Department in possession of the Data with respect to federal and state law, rules, or regulations.
ARTICLE 2. DEFINITIONS
A. “Authorized Purpose” means the specific purpose or purposes described in Attachment 1, Scope of Data Exchange of this ADSA for the specific participating state Departments to fulfill the obligations under the Scope of Data Exchange or any other purpose expressly authorized in writing in advance.
B. “Authorized User” means a person
1. Who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze Data pursuant to this ADSA; and
2. Who has completed training in privacy, security, and Incident response and who has agreed to be bound by the terms of this ADSA.
C. “Data” refers to the data requirements enlisted in the Scope of Data Exchange.
D. “Disclosing Department” means the Department disclosing Data under this ADSA and any applicable Scope of Data Exchange. A Disclosing Department maintains primary responsibility for the Data.
E. “Receiving Department” means the Department receiving Data under this ADSA and any applicable Scope of Data Exchange.
F. “Incident” means successful unauthorized access, use, disclosure, exposure, modification, destruction, release, theft, or loss of Data or interference with systems operations in an information system. This could be accidental or intentional and under automated or human control.
ARTICLE 3. SCOPE OF DATA EXCHANGE
Additional requirements for the Access of Data shall be outlined in Attachment 1, Scope of Data
Exchange
ARTICLE 4. DISCLOSING DEPARTMENT DUTIES
A. The Disclosing Department shall ensure it has the authority to share the requested Data and will maintain compliance with all applicable laws, rules, and regulations regarding any Data shared.
B. If the Disclosing Department transmits or stores Data via electronic means, the Disclosing
Department shall utilize secure file transfer protocol or encryption in motion and at rest and other applicable security controls in accordance with the most current version of the National
Institute of Standards in Technology, Special Publication 800-53, or other equally protective security controls. The Disclosing Department shall transmit the Data in a secure manner as specified in the Scope of Data Exchange.
ARTICLE 5. RECEIVING DEPARTMENT DUTIES
A. The Receiving Department shall exercise reasonable care to protect the Data from being used in any manner inconsistent with this ADSA or any applicable Scope of Data Exchange.
B. The Receiving Department shall ensure only Authorized Users will have access to the Data and access will be limited to accomplish the Authorized Purpose.
C. The Receiving Department shall establish, implement, and maintain administrative, physical, and technical safeguards to preserve and maintain the confidentiality, integrity, and availability of the Data.
D. The Receiving Department shall maintain updated privacy, security, and Incident response and reporting policies and procedures.
E. The Receiving Department shall not disclose Data to any person other than an Authorized
User.
F. The Receiving Department will establish, implement, and maintain corrective actions against any employee or contractor who fails to comply with this ADSA.
G. The Receiving Department shall notify the Disclosing Department if any additional Data is needed and will execute an amended Attachment 1, Scope of Data Exchange before receiving the additional Data.
H. Unless otherwise specified in the Scope of Data Exchange, the Receiving Department must destroy the Data upon completion or termination of the Scope of Data Exchange or this ADSA.
I. If the Receiving Department transmits or stores data via electronic means, the Receiving
Department shall utilize secure file transfer protocol or encryption in motion and at rest and other applicable security controls in accordance with the most current version of the National
Institute of Standards in Technology, Special Publication 800-53, or other equally protective security controls. The Receiving Department shall transmit the Data in a secure manner as specified in the Scope of Data Exchange.
J. The Receiving Department shall designate a privacy officer and a security officer, who may be the same individual. The Receiving Department will provide contact information for these officials to the Disclosing Department.
K. The Receiving Department shall timely cooperate with any request for audit participation.
L. The Receiving Department shall comply with all laws, rules, and regulations applicable to the
Data.
ARTICLE 6. INCIDENT RESPONSE, REPORTING, AND CORRECTIVE ACTION
A. All participating Departments shall comply with the Incident response, reporting, and corrective action requirements in accordance with applicable laws and Attachment 1, Scope of
Data Exchange.
B. Any Incident discovered by a Receiving Department shall be reported to the Disclosing
Department and to the Cyber Insurance Program (ar.cyberclaims@bxsi.com) within 24 hours of discovery.
C. An Incident is considered discovered on the first business day the Receiving Department knows or should have reasonably known about it.
D. The Receiving Department shall provide detailed information to the Disclosing Department about the Incident along with the names and contact information of any individuals affected.
ARTICLE 7. GENERAL PROVISIONS
A. The Disclosing Department shall maintain ownership and primary responsibility of its Data shared under this ADSA. Any Receiving Department who receives a request for the Data through a Freedom of Information Request, subpoena or other legal proceeding, or from another Department, shall seek permission from the Disclosing Department prior to any release.
B. Additional Terms
1. This ADSA shall remain in effect until terminated by all parties. A participating Department may terminate its participation in the ADSA by providing 30 days notice to all participating Departments and the designated ADSA coordinator. If the terminating Department has disclosed or received Data, it must work with the appropriate Department to construct a plan for discontinuing the use of the Data.
2. This ADSA may not be amended without written agreement from all participants.
3. Participating Departments shall use Attachment 1, Scope of Data Exchange to outline additional terms and conditions of any data exchange.
4. Nothing in this ADSA shall preclude participating Departments from sharing data with participating or non-participating parties through an independent agreement.
5. This ADSA may be executed in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same agreement.
6. This ADSA does not supersede any existing statutory authority.
7. All Data requests are subject to the Disclosing Department’s approval processes.
By my signature, we desire to be a participating Department and agree to abide by the terms of this ADSA.
DEPARTMENT NAME: ________________________________________
SIGNATURE: _________________________________________________
TITLE: _______________________________________________________
DATE: _____________________________
File details come from the government source that posted it. Updated .