Business_Associate_Agreement_(HIPAA).pdf

Contractor Name

FV259002

DDS CISR (12-20)

Confidentiality and Information Security Requirements for Contracts Not Requiring a HIPAA Business Associate Agreement

This Confidentiality and Information Privacy and Security Requirements Exhibit (For Non-HIPAA/HITECH Act Contracts) (“this Exhibit”) sets forth the information privacy and security requirements Contractor is obligated to follow with respect to all personal, confidential, and sensitive information (“PCSI”) (as defined herein) disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of the California Department of Developmental Services (“DDS”), pursuant to Contractor’s agreement with DDS. DDS and Contractor desire to protect the privacy and provide for the security of DDS’s PCSI pursuant to this Exhibit and in compliance with state and federal laws applicable to DDS.

I. Order of Precedence: With respect to information privacy and security requirements for DDS’s PCSI, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the agreement between Contractor and DDS, including Exhibit A (Scope of Work), all other exhibits and any other attachments, and shall prevail over any such conflicting terms or conditions.

II. Effect on lower tier transactions: The terms of this Exhibit shall apply to all contracts, subcontracts, and subawards, and the information privacy and security requirements Contractor is obligated to follow with respect to DDS’s PCSI disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of DDS, pursuant to Contractor’s agreement with DDS. When applicable, the Contractor shall incorporate the relevant provisions of this Exhibit into each subcontract or subaward to its agents, subcontractors, or independent consultants.

III. Definitions: For purposes of the agreement between Contractor and DDS including this Exhibit, the following definitions shall apply:

A. Breach:

“Breach” means, including but not limited to:

1. the unauthorized acquisition, access, use, or disclosure of DDS’s PCSI in a manner which compromises the security, confidentiality, or integrity of the information; or

2. the same as the definition of "breach of the security of the system" set forth in California Civil Code section 1798.29, subdivision(f).

B. Confidential Information: “Confidential information” means information that:

1. does not meet the definition of “public records” set forth in California Government Code section 6252, subdivision (e), or is exempt from disclosure under any of the provisions of Section 6250, et seq. of the California Government Code or any other applicable state or federal laws; or

2. is contained in documents, files, folders, books or records that are clearly labeled, marked or designated with the word “confidential” by DDS.

C. Disclosure: “Disclosure” means the release, transfer, provision of, access to, or divulging in any

DDS CISR (12-20)

H. Use: “Use” means the sharing, employment, application, utilization, examination, or analysis of information.

manner of information outside the entity holding the information.

D. PCSI: “PCSI” means “personal information,” “confidential information,” and “sensitive information” (as these terms are defined herein).

E. Personal Information: “Personal information” means information, in any medium (including but not limited to paper, electronic, oral) that:

1. directly or indirectly collectively identifies or uniquely describes an individual; or

2. could be used in combination with other information to indirectly identify or uniquely describe an individual, or link an individual to the other information; or

3. meets the definition of “personal information” set forth in California Civil Code section 1798.3, subdivision (a) or

4. is one of the data elements set forth in California Civil Code section 1798.29, subdivision (g)(1) or (g)(2); or

5. meets the definition of “medical information” set forth in either California Civil Code section 1798.29, subdivision (h)(2) or California Civil Code section 56.05, subdivision (j); or

6. meets the definition of “health insurance information” set forth in California Civil Code section 1798.29, subdivision (h)(3); or

7. is protected from disclosure under applicable state or federal law.

F. Security Incident: “Security Incident” means:

1. an attempted breach; or

2. the attempted or successful unauthorized access, disclosure, modification, or destruction of DDS PCSI, in violation of any applicable state or federal law or in a manner not permitted under the agreement between Contractor and DDS, including this Exhibit; or

3. the attempted or successful modification or destruction of, or interference with, Contractor’s system operations in an information technology system, that negatively impacts the confidentiality, availability, or integrity of DDS’s PCSI; or

4. any event that is reasonably believed to have compromised the confidentiality, integrity, or availability of an information asset, system, process, data storage, or transmission.

Furthermore, an information security incident may also include an event that constitutes a violation or imminent threat of violation of information security policies or procedures, including acceptable use policies.

G. Sensitive Information: “Sensitive Information” is information maintained by DDS, which is not confidential by definition, but requires special precautions to protect it from unauthorized access and/or modification (i.e., financial or operational information). Sensitive information may be either public or confidential. Sensitive information is that information, for which disclosure would jeopardize the integrity of DDS.

DDS CISR (12-20)

IV. Background check: Before Contractor’s employee or workforce member (collectively “workforce members”) may access DDS PCSI, the Contractor, at its discretion (based on compliance with applicable federal and state laws related to its programs), will conduct a thorough background check of the workforce member and evaluate the results to assure that there is no indication that the workforce member may present a risk for theft of confidential data. The Contractor shall retain each workforce member’s background check documentation for a period of three (3) years following contract termination.

V. Disclosure Restrictions: The Contractor and its employees, agents, and subcontractors shall protect from unauthorized disclosure any DDS PCSI. The Contractor shall not disclose, except as otherwise specifically permitted by the agreement between Contractor and DDS (including this Exhibit). If the Contractor anticipates or wishes to disclose DDS PCSI in a manner not permitted by this agreement, it shall obtain DDS’s prior written authorization from the DDS Program Contract Manager, unless disclosure is required by State or Federal law.

VI. Use Restrictions: The Contractor and its employees, agents, and subcontractors shall not use any DDS PCSI for any purpose other than performing the Contractor's obligations under its agreement with DDS.

VII. Safeguards: The Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the privacy, confidentiality, security, integrity, and availability of DDS’s PCSI, including electronic or computerized DDS PCSI. At each location where DDS PCSI exists under Contractor’s control. The Contractor shall develop and maintain a written information privacy and security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the Contractor’s operations and the nature and scope of its activities in performing its agreement with DDS, including this Exhibit, and which incorporates the requirements of Section VIII, Security, below. Contractor shall provide DDS with Contractor’s current and updated policies within five

(5) business days of a request by DDS.

VIII. Security: The Contractor shall take any and all steps reasonably necessary to ensure the continuous security of all computerized data systems containing DDS’s PCSI. These steps shall include, at a minimum, complying with all of the data system security precautions listed in the Contractor Data Security Standards set forth in Attachment 1 to this Exhibit.

IX. Security Officer: At each place where DDS PCSI is located, the Contractor shall designate a Security Officer to oversee its compliance with this Exhibit and to communicate with DDS on matters concerning this Exhibit.

X. Training: The Contractor shall provide, at a minimum, annual training on its obligations under this Exhibit, at its own expense, to all of its workforce members who assist in the performance of Contractor’s obligations under Contractor’s agreement with DDS, including this Exhibit, or otherwise use or disclose DDS PCSI. Workforce members shall not begin work or have access to DDS PCSI until they have completed this training.

A. The Contractor shall require each workforce member who receives training to certify, either in hard copy or electronic form, the date on which the training was completed.

B. The Contractor shall retain each workforce member’s certifications for DDS inspection for a period of three (3) years following contract termination or completion.

C. Contractor shall provide DDS with its workforce member’s certifications within five (5) business days of a request by DDS for the workforce member’s certifications.

DDS CISR (12-20)

XII. Breach and Security Incident Responsibilities:

A. Notification to DDS ISO of Breach or Security Incident: The Contractor shall notify the DDS immediately by telephone call plus email or fax upon the discovery of a breach (as defined in this Exhibit), and within twenty-four (24) hours by email or fax of the discovery of any security incident (as defined in this Exhibit), unless a law enforcement agency determines that the notification will impede a criminal investigation, in which case the notification required by this section shall be made to DDS immediately after the law enforcement agency determines that such notification will not compromise the investigation. Notification shall be provided to the DDS Program Contract Manager, the DDS Privacy Officer and the DDS Chief Information Security Officer, using the contact information listed in Section XII(F), below. If the breach or security incident is discovered after business hours or on a weekend or holiday and involves DDS PCSI in electronic or computerized form, notification to DDS shall be provided by calling the DDS Information Security Office at the telephone numbers listed in Section XII(F), below. For purposes of this Section, breaches and security incidents shall be treated as discovered by Contractor as of the first day on which such breach or security incident is known to the Contractor, or, by exercising reasonable diligence would have been known to the Contractor.

Contractor shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member of the Contractor.

Contractor shall take:

1. prompt corrective action to mitigate any risks or damages involved with the breach or security incident and to protect the operating environment; and

2. any action pertaining to a breach required by applicable federal and state laws, including, specifically, State Administrative Manual (SAM) section 5340, Incident Management, and California Civil Code 1798.82. If Contractor is a state agency it must also take breach actions specified under California Civil Code section 1798.29, subdivision (e).

XI. Employee and Workforce Member Discipline: Contractor shall impose discipline that it deems appropriate (in its sole discretion) on such employees and other Contractor workforce members under Contractor’s direct control who intentionally or negligently violate any provisions of this Exhibit.

B. Investigation of Breach and Security Incidents: The Contractor shall immediately investigate such breach or security incident. As soon as the information is known and subject to the legitimate needs of law enforcement, Contractor shall inform the DDS Program Contract Manager, the DDS Privacy Officer, and the DDS Chief Information Security Officer of:

1. what data elements were involved and the extent of the data disclosure or access involved in the breach, including, specifically, the number of individuals whose personal information was breached; and

2. a description of the unauthorized persons known or reasonably believed to have improperly used the DDS PCSI and/or a description of the unauthorized persons known or reasonably believed to have improperly accessed or acquired the DDS PCSI, or to whom it is known or reasonably believed to have had the DDS PCSI improperly disclosed to them; and

3. a description of where the DDS PCSI is believed to have been improperly used or disclosed;

and

4. a description of the probable and proximate causes of the breach or security incident; and

DDS CISR (12-20)

5. whether Civil Code section 1798.29 or any other federal or state laws, if applicable, requiring individual notifications of breaches have been triggered.

C. Written Report: The Contractor shall provide a written report of the investigation to the DDS Privacy Officer and the DDS Chief Information Security Officer as soon as practicable after the discovery of the breach or security incident. The report shall include, but not be limited to, the information specified above, as well as a complete, detailed corrective action plan, including information on measures that were taken to halt and/or contain the breach or security incident, and measures to be taken to prevent the recurrence or further disclosure of data regarding such breach or security incident.

D. Notification to Individuals: If notification to individuals whose information was breached is required under state or federal law, and regardless of whether Contractor is considered only a custodian and/or non-owner of the DDS PCSI, Contractor shall, at its sole expense, and at the sole election of DDS, either:

1. make notification to the individuals affected by the breach (including substitute notification), pursuant to the content and timeliness provisions of such applicable state or federal breach notice laws. Contractor shall inform the DDS Privacy Officer of the time, manner, and content of any such notifications, prior to the transmission of such notifications to the individuals; or

2. cooperate with and assist DDS in its notification (including substitute notification) to the individuals affected by the breach.

E. Submission of Sample Notification to Attorney General: If notification to more than 500 individuals is required pursuant to California Civil Code section 1798.29 or California Civil Code section 1798.82, and regardless of whether Contractor is considered only a custodian and/or non-owner of the DDS PCSI, Contractor shall, at its sole expense, and at the sole election of DDS, either:

1. electronically submit a single sample copy of the security breach notification, excluding any personally identifiable information, to the Attorney General pursuant to the format, content and timeliness provisions of Section 1798.29, subdivision (e) or Section 1798.82, subdivision (f). Contractor shall inform the DDS Privacy Officer of the time, manner and content of any such submissions, prior to the transmission of such submissions to the Attorney General; or

2. cooperate with and assist DDS in its submission of a sample copy of the notification to the Attorney General.

F. DDS Contact Information: To direct communications to the above referenced DDS staff, the Contractor shall initiate contact as indicated herein. DDS reserves the right to make changes to the contact information below by verbal or written notice to the Contractor. Said changes shall not require an amendment to this Exhibit or the agreement to which it is incorporated.

DDS CISR (12-20)

DDS Program Contract Manager

DDS Privacy Officer DDS Chief Information Security Officer

See the Scope of Work exhibit for Program Contract Manager

Privacy Officer privacy@dds.ca.gov

(916) 654-2120

Information Security Officer iso@dds.ca.gov

(916) 654-1704

XIII. Documentation of Disclosures for Requests for Accounting: Contractor shall document and make available to DDS or (at the direction of DDS) to an Individual such disclosures of DDS PCSI, and information related to such disclosures, necessary to respond to a proper request by the subject Individual for an accounting of disclosures of personal information as required by Civil Code section 1798.25, or any other applicable state or federal law.

XIV. Requests for DDS PCSI by Third Parties: The Contractor and its employees, agents, or subcontractors shall promptly transmit to the DDS Program Contract Manager all requests for disclosure of any DDS PCSI requested by third parties to the agreement between Contractor and DDS (except from an Individual for an accounting of disclosures of the individual’s personal information pursuant to applicable state or federal law), unless prohibited from doing so by applicable state or federal law.

XV. Notification of Requests by Other Entities of DDS PCSI: If the Contractor and its employees, agents, or subcontractors receive a subpoena, warrant, other legal order, demand, or Public Records Act Request (collectively, a “Request”), seeking DDS PCSI, it will promptly notify the DDS Privacy Officer and DDS Chief Information Security Officer and provide a copy of the Request along with copies of Records or data in its possession that it believes are responsive to the Request. In the event of a Request, the parties agree to consult and cooperate with each other in their respective responses, as appropriate.

XVI. Audits, Inspection and Enforcement: DDS may inspect the facilities, systems, books and records of Contractor to monitor compliance with this Exhibit. Contractor shall promptly remedy any violation of any provision of this Exhibit and shall certify the same to the DDS Program Contract Manager in writing.

XVII. Return or Destruction of DDS PCSI on Expiration or Termination: Upon expiration or termination of the agreement between Contractor and DDS for any reason, Contractor shall securely destroy the DDS PCSI within 15 days of the expiration or termination of the agreement. If return or destruction is not feasible, Contractor shall provide a written explanation within 15 days to the DDS Program Contract Manager, the DDS Privacy Officer and the DDS Chief Information Security Officer, using the contact information listed in Section XII(F), above.

A. Retention Required by Law: If required by state or federal law, Contractor may retain, after expiration or termination, DDS PCSI for the time specified as necessary to comply with the law.

B. Obligations Continue Until Return or Destruction: Contractor’s obligations under this Exhibit shall continue until Contractor returns or destroys the DDS PCSI or returns the DDS PCSI to DDS; provided however, that on expiration or termination of the agreement between Contractor and DDS, Contractor shall not further use or disclose the DDS PCSI except as required by state or federal law.

mailto:privacy@dds.ca.gov

DDS CISR (12-20)

C. Notification of Election to Destroy DDS PCSI: If Contractor destroys the DDS PCSI, Contractor shall certify in writing, to the DDS Program Contract Manager, the DDS Privacy Officer and the DDS Chief Information Security Officer, using the contact information listed in Section XII(F), above, that the DDS PCSI has been securely destroyed. The notice shall include the date and type of destruction method used.

XVIII. Amendment: The parties acknowledge that federal and state laws regarding information security and privacy rapidly evolve and that amendment of this Exhibit may be required to provide for procedures to ensure compliance with such laws. The parties specifically agree to take such action as is necessary to implement new security standards as they become published and implement requirements imposed by regulations and other applicable laws relating to the security or privacy of

DDS PCSI.

XIX. Assistance in Litigation or Administrative Proceedings: Contractor shall make itself and any subcontractors, workforce employees or agents assisting Contractor in the performance of its obligations under the agreement between Contractor and DDS, available to DDS at no cost to DDS to testify as witnesses, in the event of litigation or administrative proceedings being commenced against DDS, its director, officers or employees based upon claimed violation of laws relating to security and privacy, which involves inactions or actions by the Contractor, except where Contractor or its subcontractor, workforce employee or agent is a named adverse party.

XX. No Third-Party Beneficiaries: Nothing express or implied in the terms and conditions of this Exhibit is intended to confer, nor shall anything herein confer, upon any person other than DDS or Contractor and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.

XXI. Interpretation: The terms and conditions in this Exhibit shall be interpreted as broadly as necessary to implement and comply with regulations and applicable State laws. The parties agree that any ambiguity in the terms and conditions of this Exhibit shall be resolved in favor of a meaning that complies and is consistent with federal and state laws and regulations.

XXII. Survival: If Contractor does not return or destroy the DDS PCSI upon the completion or termination of the Agreement, the respective rights and obligations of Contractor under Sections VI, VII and XII of this Exhibit shall survive the completion or termination of the agreement between Contractor and

DDS.

DDS CISR (12-20)

Attachment 1 Contractor Data Security Standards

1. General Security Controls

A. Confidentiality Statement. All persons that will be working with DDS PCSI must sign a confidentiality statement (Attachment 2 to this Exhibit). The statement must include at a minimum, General Use, Security and Privacy safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to accessing DDS PCSI. The statement must be renewed annually. The Contractor shall retain each person’s confidentiality statement for DDS inspection for a period of three (3) years following contract termination.

B. Workstation/Laptop encryption. All workstations, laptops, devices (including smart phones) that process and/or store DDS PCSI must be encrypted, at a minimum, using a FIPS 140-2 certified algorithm or successor standards, such as Advanced Encryption Standard (AES), with a 128bit key or higher. The encryption solution must be full disk unless approved by the DDS Information Security Office. Contact the DDS State Contract Manager to obtain a copy of the CHHS Security Policy – Data Encryption.

C. Server Security. All servers containing DDS PCSI must be encrypted, at a minimum, using a FIPS 140-2 certified algorithm or successor standards, such as Advanced Encryption Standard (AES), with a 128bit key or higher; and have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review.

D. Minimum Necessary. Only the minimum necessary amount of DDS PCSI required to perform necessary business functions may be copied, downloaded, or exported.

E. Removable media devices. All electronic files that contain DDS PCSI data must be encrypted when stored on any removable media or portable device (i.e. USB thumb drives, floppies, CD/DVD, smart devices tapes etc.). PCSI must be encrypted, at a minimum, using a FIPS 140-2 certified algorithm or successor standards, such as Advanced Encryption Standard (AES), with a 128bit key or higher

F. Antivirus software. All workstations, laptops and other systems that process and/or store DDS PCSI must install and actively use a comprehensive anti-virus software solution with automatic updates scheduled at least daily.

G. Patch Management. All workstations, laptops and other systems that process and/or store DDS PCSI must have operating system and application security patches applied, with system reboot if necessary. There must be a documented patch management process which determines installation timeframe based on risk assessment and vendor recommendations. All applicable patches must be up to date and installed in a timely manner as determined by the DDS.

H. User IDs and Password Controls. All users must be issued a unique user name for accessing DEPT. ACRONYM PCSI. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee with knowledge of the password. Passwords are not to be shared. Must be at least eight characters. Must be a non-dictionary word. Must not be stored in readable format on the computer. Must be

DDS CISR (12-20)

changed every 60 days. Must be changed if revealed or compromised. Must be composed of characters from at least three of the following four groups from the standard keyboard:

• Upper case letters (A-Z)

• Lower case letters (a-z)

• Arabic numerals (0-9)

• Non-alphanumeric characters (punctuation symbols)

I. Data Sanitization. All DDS PCSI must be sanitized using NIST Special Publication 800-88 standard methods for data sanitization when the DDS PCSI is no longer needed.

2. System Security Controls

A. System Timeout. The system must provide an automatic timeout, requiring reauthentication of the user session after no more than 20 minutes of inactivity.

B. Warning Banners. All systems containing DDS PCSI must display a warning banner each time a user attempts access, stating that data is confidential, systems are logged, and system use is for business purposes only. User must be directed to log off the system if they do not agree with these requirements.

C. System Logging. The system must maintain an automated audit trail which can identify the user or system process which initiates a request for DDS PCSI, or which alters DDS PCSI.

The audit trail must be date and time stamped, must log both successful and failed accesses, must be read only, and must be restricted to authorized users. This logging must be included for all user privilege levels including, but not limited to, systems administrators.

If DDS PCSI is stored in a database, database logging functionality must be enabled. Audit trail data must be archived for at least 3 years after occurrence.

D. Access Controls. The system must use role based access controls for all user authentications, enforcing the principle of least privilege.

E. Transmission encryption. All data transmissions of DDS PCSI outside the contractor’s secure internal network must be encrypted using a FIPS 140-2 certified algorithm or successor standards, such as Advanced Encryption Standard (AES), with a 128bit key or higher. Encryption can be end to end at the network level, or the data files containing DDS PCSI can be encrypted. This requirement pertains to any type of DDS PCSI in motion such as website access, file transfer, and E-Mail.

F. Intrusion Detection. All systems involved in accessing, holding, transporting, and protecting DDS PCSI that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.

3. Audit Controls

A. System Security Review. All systems processing and/or storing DDS PCSI must have at least an annual system risk assessment/security review which provides assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews shall include vulnerability scanning tools.

B. Log Reviews. All systems processing and/or storing DDS PCSI must have a routine procedure in place to review system logs for unauthorized access.

DDS CISR (12-20)

C. Change Control. All systems processing and/or storing DDS PCSI must have a documented change control procedure that ensures separation of duties and protects the confidentiality, integrity, and availability of data.

4. Business Continuity / Disaster Recovery Controls

A. Disaster Recovery. Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of electronic DDS PCSI in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this agreement for more than 24 hours.

B. Data Backup Plan. Contractor must have established documented procedures to securely backup DDS PCSI to maintain retrievable exact copies of DDS PCSI. The backups shall be encrypted. The plan must include a regular schedule for making backups, storing backups offsite, an inventory of backup media, and the amount of time to restore DDS PCSI should it be lost. At a minimum, the schedule must be a weekly full backup and monthly offsite storage of DDS data.

5. Paper Document Controls

A. Supervision of Data. DDS PCSI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information.

DDS PCSI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

B. Escorting Visitors. Visitors to areas where DDS PCSI is contained shall be escorted and DDS PCSI shall be kept out of sight while visitors are in the area.

C. Confidential Destruction. DDS PCSI must be disposed of through confidential means, using NIST Special Publication 800-88 standard methods for data sanitization or successor standards when the DDS PSCI is no longer needed.

D. Removal of Data. DDS PCSI must not be removed from the premises of the Contractor except with express written permission of DDS.

E. Faxing. Faxes containing DDS PCSI shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending.

F. Mailing. DDS PCSI shall only be mailed using secure methods. Large volume mailings of DDS PCSI shall be by a secure, bonded courier with signature required on receipt. Disks and other transportable media sent through the mail must be encrypted with a DDS approved solution.

DDS CISR (12-20)

Attachment 2

CALIFORNIA DEPARTMENT OF DEVELOPMENTAL SERVICES

CONFIDENTIALITY AND SECURITY COMPLIANCE STATEMENT

Information resources maintained by the California Department of Developmental Services (“DDS”) and provided to Contractor may contain personal, confidential and/or sensitive information (“PCSI”) that is not open to the public and requires special precautions to protect it from wrongful access, use, disclosure, modification, and destruction.

We hereby acknowledge that the PCSI of the DDS is subject to strict confidentiality and security requirements imposed by state and federal law, which may include, but are not limited to the Information Practices Act – California Civil Code §1798 et seq., Public Records Act – California Government Code §6250 et seq., California Penal Code §502, 11140-11144, Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) – 45 CFR Parts 160 and 164, the California Welfare and Institutions Code §§10850, 4514, 5328, and Safeguarding Information for the Financial Assistance Programs – 45 CFR Part 205.50.

The Confidentiality and Security Compliance Statement must be signed and returned with the Contract.

Project Representative

Name (Printed): ________________________________________________________________________________

Title: ________________________________________________________________________________

Business Name: ________________________________________________________________________________

Email Address: __________________________________________________________________________________

Phone: ________________________________________________________________________________

Signature: ________________________________________________________________________________

Date Signed: ________________________________________________________________________________

Information Security Officer (or authorized official responsible for business’ information security program)

Name (Printed): ________________________________________________________________________________

Title: ________________________________________________________________________________

Business Name: ________________________________________________________________________________

Email Address: __________________________________________________________________________________

Phone: ________________________________________________________________________________

Signature: ________________________________________________________________________________

Date Signed: ________________________________________________________________________________

34. Confidentiality of Data