ERS Confidentiality_Agreement.pdf

Confidentiality Agreement (ERS Vendor) 01/22/2016

CONFIDENTIALITY AGREEMENT

(Employees’ Retirement System Vendor)

THIS CONFIDENTIALITY AGREEMENT (“Agreement”) is entered into by

______________________________________________________________ (“Vendor”), a

______________________________________________________________________, whose address is _______________________________________________________________, for the benefit of the EMPLOYEES’ RETIREMENT SYSTEM OF THE STATE OF HAWAII

(“ERS”), with reference to the following:

WHEREAS, during the course of providing goods or services to the ERS, Vendor and

Vendor’s employees, subcontractors, consultants, or agents may come into possession of certain confidential information; and

WHEREAS, the purpose of this Agreement is to set forth Vendor’s responsibilities with respect to the confidential information;

NOW, THEREFORE, for good consideration and as a condition of working at ERS worksites or accessing ERS systems, Vendor agrees as follows:

1. Definitions. The following words and phrases, as used in this Agreement, shall have the following meanings:

“Contract” means: The agreement dated _______________________, between Vendor and the ERS, and any amendments thereof, pursuant to which Vendor has agreed to provide goods or services to the ERS.

“Confidential Information” means: Confidential Business Information and Confidential

Personal Information provided to or made available to Vendor by the ERS, created or maintained for the ERS by Vendor, or transmitted on behalf of the ERS by Vendor.

“Confidential Business Information” means: Business plans and strategies, processes, customer/member lists and records, proposals, employee records, financial statements and information, technical information, product design information, pricing or cost information, discounts, proprietary computer programs including source code and object code, technical or other proprietary manuals, copyrighted materials and all other forms of intellectual property.

“Confidential Personal Information” means:

a. An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either name or data elements are not encrypted:

(1) Social security number;

(2) Driver's license number or Hawaii identification card number; or

(3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial information.

b. Information in which an individual has a significant privacy interest, including, without limitation the following:

(1) Information relating to medical, psychiatric, or psychological history, diagnosis, condition, treatment, or evaluation;

(2) Information relating to eligibility for ERS benefits or the determination of benefit levels; and

(3) Information describing an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or credit worthiness, including, without limitation, an individual’s employment, personnel and payroll records.

c. An individual's first name or first initial and last name in combination with any one or more of the following data elements:

(1) Date of birth;

(2) Address; or

(3) Phone numbers.

Confidential Personal Information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

"Information" includes all information, regardless of the format, including, without limitation, information presented in written, drawn, spoken, visual, or electromagnetic format.

“Technological safeguards” means: the technology and the policy and procedures for use of the technology to protect and control access to Confidential Information.

2. Confidentiality of Information.

a. All Information provided to or made available to the Vendor by the ERS shall be used by Vendor only for the purpose of providing goods or services under the Contract and may not be disclosed without the prior written approval of the ERS.

b. All Confidential Information shall be safeguarded by Vendor. In safeguarding the

Confidential Information, the Vendor shall comply with, inter alia, the applicable provisions of

Hawaii Revised Statutes chapters 487J, 487N and 487R. Vendor agrees not to retain, use, or disclose, or permit Vendor’s employees, subcontractors, consultants, or agents to retain, use, or disclose, Confidential Information for any purpose other than as permitted or required by this

Agreement or the Contract.

c. Vendor agrees to implement, and ensure that any subcontractors to whom Vendor provides access to Confidential Information implement, appropriate technological safeguards that are acceptable to the ERS to reduce the risk of unauthorized access to the Confidential

Information and to prevent the unauthorized use or disclosure of the Confidential Information.

d. Vendor shall promptly (and in any event within twenty-four hours of discovery) and completely report to the ERS any security breaches or potential security breaches involving

Confidential Information. If the breach or potential breach involves Confidential Personal

Information, such notification shall include: (1) the names of the individuals affected, (2) a description of the circumstances of the breach, (3) the date of the breach, (3) the date of discovery of the breach, (4) the information breached, (5) any steps affected individuals should take to protect themselves from potential harm, (6) the steps Vendor (or its agent) is taking to investigate the breach, mitigate losses, and protect against future breaches, and (7) contact information for individuals or entities to obtain more information regarding the breach, including a telephone number, e-mail address, website, or postal address.

e. Vendor agrees to mitigate any harmful effect that is known to Vendor because of a use or disclosure of Confidential Information by Vendor, or by Vendor’s employees, contractors, consultants, or agents, in violation of the requirements of this Agreement.

g. Vendor shall complete and retain a log of all disclosures made of Confidential

Information. The log shall, at a minimum, be sufficient for the ERS to determine Vendor's compliance with this Agreement.

h. Vendor shall make internal practices, books, and records, including policies and procedures, relating to the use and disclosure of Confidential Information, available to the ERS.

3. Security Awareness Training and Confidentiality Agreements.

a. Vendor certifies that all of its employees who will have access to Confidential

Information have completed training on security awareness topics relating to protecting

Confidential Information.

b. Vendor certifies that confidentiality agreements have been signed by all of its employees, subcontractors, consultants, and agents who will have access to Confidential

Information acknowledging that:

(1) Confidential Information will be treated as confidential in a manner consistent with this Agreement;

(2) Access to Confidential Information will be allowed only as necessary to perform the Contract; and

(3) Use of Confidential Information will be restricted to uses consistent with the services subject to the Contract.

4. Indemnification and Defense. The Vendor shall defend, indemnify, and hold harmless the ERS and its trustees, employees, and agents from and against all liability, loss, damage, cost and expense, including all attorneys’ fees, and all claims, suits, and demands therefore, arising out of or resulting from the Vendor’s breach of the Vendor’s obligations under this Agreement or from the retention, use, or disclosure of Confidential Information by Vendor’s employees, contractors, consultants, or agents for any purpose other than as permitted or required by this Agreement or the Contract. The liability, loss, damage, costs, expense, claims, suits, and demands referred to in this paragraph include, without limitation, the costs and expenses for complying with section 487N-2, Hawaii Revised Statutes, and any other claims arising out of, and costs and expenses of any other actions that the ERS reasonably believes are necessary for the mitigation of, security breaches or potential relating to Confidential Personal Information.

The provisions of this paragraph shall survive termination or completion of the Contract.

5. Termination for Cause. In addition to any other remedies provided for by this

Agreement or the Contract, if the ERS learns of a material breach by Vendor of this Agreement by Vendor, the ERS may at its sole discretion:

a. Provide an opportunity for the Vendor to cure the breach or end the violation; or

b. Immediately terminate the Contract.

(Name of Vendor)

(Signature)

(Print Name)

(Print Title)

(Date)