Attachment E - Personal Information Security & Breach Investigation Act-HB5.pdf
PDF 664 KB Posted
- Attached to
- Kentucky 811 Training Module Re-Bid
- Solicitation number
- RFP 758 2600000373 1
- Issued by
- Kentucky
About this file
This is an attachment to a Request for Proposal (RFP) for the Kentucky 811 Training Module Re-Bid issued by the Commonwealth of Kentucky, specifically outlining the Personal Information Security and Breach Investigation Act (HB 5) requirements applicable to vendors. The document establishes mandatory security and data protection standards for any vendor that receives, accesses, collects, or maintains personal information as defined under Kentucky Revised Statutes (KRS 61.931 et seq.). Personal Information includes an individual's name combined with sensitive data elements such as account numbers, Social Security numbers, driver's license numbers, passport numbers, or health information protected under the Health Insurance Portability and Accountability Act. Vendors are required to implement security and breach investigation procedures that meet or exceed standards established by the Commonwealth Office of Technology and must immediately notify the contracting agency, Office of Procurement Services, Commonwealth Office of Technology, and NG-KIH Program Office of any security breaches within seventy-two hours, unless specific statutory exceptions apply.
The vendor must undertake prompt and reasonable investigations of any breaches as required by statute and share proportional responsibility for costs related to breach notification, investigation, and mitigation. The Commonwealth reserves the right to withhold payment from vendors who fail to comply with identity theft prevention reporting requirements. Vendors are obligated to maintain, implement, and update their security procedures to align with Commonwealth Office of Technology standards, which are referenced at https://technology.ky.gov/OCISO/Pages/InformationSecurityPoliciesStandardsandProcedures.aspx. Compliance with these requirements is a condition of contract performance and represents a critical component of the overall procurement terms for this training module re-bid opportunity.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment A-Terms and Conditions-RFP 758 2600000373.pdf | ||
| Attachment B - Cost Proposal Form-RFP 758 2600000373.xlsx | XLSX spreadsheet | |
| Attachment C - Annual Affidavit and Other Affidavits.pdf | ||
| Final_RFP_758_2600000373_1_SO_FORM.PDF | ||
| Attachment D - Vendors Question Form- RFP 758 2600000373.xlsx | XLSX spreadsheet | |
| Attachment F - Mandatory Requirements Checklist-RFP 758 2600000373.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Protection of Personal Information Security and Breach Investigation Procedures and Practices Act
Vendors that receive Personal Information as defined by and in accordance with Kentucky’s Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, et seq., (the “Act”), shall secure and protect the Personal Information by, without limitation, complying with all requirements applicable to non-affiliated third parties set forth in the Act.
“Personal Information” is defined in accordance with KRS 61.931(6) as “an individual’s first name or first initial and last name; personal mark; or unique biometric or genetic print or image, in combination with one (1) or more of the following data elements:
a) An account number, credit card number, or debit card number that, in combination with any required security code, access code or password, would permit access to an account;
b) A Social Security number;
c) A taxpayer identification number that incorporates a Social Security number;
d) A driver’s license number, state identification card number or other individual identification number issued by an agency;
e) A passport number or other identification number issued by the United States government; or
f) Individually Identifiable Information as defined in 45 C.F.R. sec. 160.013 (of the
Health Insurance Portability and Accountability Act), except for education records covered by the Family Education Rights and Privacy Act, as amended 20 U.S.C. sec 1232g.”
As provided in KRS 61.931(5), a “non-affiliated third party” means “any person or entity that has a contract or agreement with the Commonwealth and receives (accesses, collects or maintains) personal information from the Commonwealth pursuant to the contract or agreement.”
The vendor hereby agrees to cooperate with the Commonwealth in complying with the response, mitigation, correction, investigation, and notification requirements of the Act.
The vendor shall immediately notify as soon as possible, but not to exceed seventy-two (72) hours, the contracting agency, the Office of Procurement Services, the Commonwealth Office of Technology and the NG-KIH Program Office of a determination of or knowledge of a breach, unless the exception set forth in KRS 61.932(2)(b)2 applies and the vendor abides by the requirements set forth in that exception.
Attachment E
RFP 758 2600000373
Kentucky 811 Training Module Re-Bid
The vendor hereby agrees that the Commonwealth may withhold payment(s) owed to the vendor for any violation of the Identity Theft Prevention Reporting Requirements.
The vendor hereby agrees to undertake a prompt and reasonable investigation of any breach as required by KRS 61.933.
Upon conclusion of an investigation of a security breach of Personal Information as required by KRS 61.933, the vendor hereby agrees to an apportionment of the costs of the notification, investigation, and mitigation of the security breach.
In accordance with KRS 61.932(2)(a) the vendor shall implement, maintain, and update security and breach investigation procedures that are appropriate to the nature of the information disclosed, that are at least as stringent as the security and breach investigation procedures and practices established by the Commonwealth Office of Technology:
https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProc edures.aspx
Kentucky 811 Training Module Re-Bid https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx
File details come from the government source that posted it. Updated .