ESBD_459044_1759418550289_Exhibit XI Data Use Agreement.pdf

THC Solicitation No. 808-26-253551 Page 1 of 10

EXHIBIT XI

DATA USE AGREEMENT

UPDATED 08/27/2025

This Data Use Agreement (DUA) is incorporated into and is effective as of the date of execution of THC Contract No. 808-26-253551 (Contract), by and between the Texas Historical Commission (THC) and the Contractor.

1. Purpose; Applicability; Order of Precedence

The purpose of this DUA is to facilitate access to, creation, receipt, maintenance, use, disclosure or transmission of Confidential Information with Contractor, and to describe Contractor’s rights and obligations with respect to Confidential Information and the limited purposes for which the Contractor may create, receive, maintain, use, disclose or have access to Confidential Information. This DUA also describes THC’s remedies in the event of Contractor’s noncompliance with its obligations under this DUA. This DUA applies to both THC business associates, and contractors who are not business associates, who create, receive, maintain, use, disclose or have access to Confidential Information on behalf of THC and its programs or clients as described in the Contract.

As of the DUA Effective Date, if any provision of the Contract conflicts with this DUA, this DUA controls.

2. Definitions

For the purpose of this DUA, capitalized, bolded terms have the following meanings:

• Authorized Purpose means the specific purpose or purposes described in the Contract for Contractor to fulfill its obligations under the Contract, or any other purpose expressly authorized by THC in writing in advance.

• Authorized User means a person:

o Who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze Confidential Information pursuant to this DUA;

o For whom Contractor warrants and represents has a demonstrable need to create, receive, maintain, use, disclose or have access to the Confidential Information; and o Who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information as required by this DUA.

• Breach means an impermissible use or disclosure of electronic or non-electronic sensitive personal information by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a risk of reputational harm, theft of financial information, identity theft, or medical identity theft. Any acquisition, access, use, disclosure, or loss of Confidential Information other than as permitted by this DUA shall be presumed to be a Breach unless Contractor demonstrates, based on a risk assessment, that there is a low probability that the Confidential Information has been compromised.

• Confidential Information means any records, including communications, (whether oral, written, electronically stored or transmitted, or in any other form) provided to or made available to Contractor or that Contractor may create, receive, maintain, use, disclose or have access to on behalf of THC that is privileged or confidential by state or federal law and regulations, including but not limited to, the following:

o Education records defined in Family Educational Rights and Privacy Act, 20 USC §§1232g et seq.; 34 CFR

Part 99 o Federal Tax Information as defined in Internal Revenue Code §6103 and Internal Revenue Service Publication 1075

THC Solicitation No. 808-26-253551 Page 2 of 10 o Personal Identifying Information (PII) as defined in Texas Business and Commerce Code, Chapter 521 o Protected Health Information (PHI) in any form, including without limitation, Electronic Protected

Health Information or Unsecured Protected Health Information as defined in 45 CFR §160.103 o Sensitive Personal Information (SPI) as defined in Chapter 521, Texas Business and Commerce Code o Social Security Administration Data, including, without limitation, Medicaid information means disclosures of information made by the Social Security Administration or the Centers for Medicare and Medicaid Services from a federal system of records for administration of federally funded benefit programs under the Social Security Act, codified as amended in Chapter 7, Title 42, United States Code o All privileged work product o All information designated as confidential under the constitution and laws of the State of Texas and of the United States, including the Texas Health & Safety Code and Texas Public Information Act, codified as amended in Chapter 552, Texas Government Code

• Destroy, Destruction for Confidential Information, means:

o Paper, film, or other hard copy media that has been shredded or destroyed such that the Confidential Information cannot be read or reconstructed. Redaction is specifically excluded as a means of data destruction.

o Electronic media that has been cleared, purged, or destroyed consistent with NIST Special Publication 800- 88, Guidelines for Media Sanitization, such that the Confidential Information cannot be retrieved.

• Discover, Discovery means the first day on which a Breach becomes known to Contractor, or, by exercising reasonable diligence should have been known to Contractor.

• Legally Authorized Representative has the meaning provided in 45 CFR § 435.923 (authorized representative); 45 CFR § 164.502(g)(1) (personal representative); Texas Occupations Code § 151.002(6);

Tex. Health & Safety Code § 166.164 (medical power of attorney); and Texas Estates Code § 22.031 (representative).

• PHI means Protected Health Information.

• Required by Law means a mandate contained in law that is enforceable in a court of law, including court orders, warrants, subpoenas or investigative demands.

• Sensitive Personal Information means, subject to Subsection (b):

o An individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted:

▪ Social Security number

▪ Driver's license number or government-issued identification number

▪ Account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account o Information that identifies an individual and relates to:

▪ The physical or mental health or condition of the individual

▪ The provision of health care to the individual

▪ Payment for the provision of health care to the individual

• Subcontractor means a person who contracts with a prime contractor to work, to supply commodities, or to contribute toward completing work for a governmental entity.

• Workforce means employees, volunteers, trainees or other persons whose performance of work is under the direct control of a party, whether or not they are paid by that party.

THC Solicitation No. 808-26-253551 Page 3 of 10

3. Contractor’s Duties and Obligations regarding Confidential Information

Contractor agrees that, as applicable under the Contract, to the following:

3.1. With respect to all Confidential Information, Contractor shall:

Exercise reasonable care and no less than the same degree of care Contractor uses to protect its own confidential, proprietary and trade secret information to prevent Confidential Information from being used in a manner that is not expressly an Authorized Purpose or as Required by Law. Contractor will access, create, maintain, receive, use, disclose, transmit or destroy Confidential Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses.

Establish, implement and maintain appropriate procedural, administrative, physical and technical safeguards to preserve and maintain the confidentiality, integrity, and availability of the Confidential Information, in accordance with applicable laws or regulations relating to Confidential Information, in order to prevent any unauthorized use or disclosure of Confidential Information as long as Contractor has such Confidential Information in its actual or constructive possession.

Implement, update as necessary, and document privacy, security and Breach notice policies and procedures and an incident response plan to address a Breach, to comply with the privacy, security and breach notice requirements of this DUA prior to conducting work under the Contract. Contractor shall produce, within three business days of a request by THC, copies of its policies and procedures and records relating to the use or disclosure of Confidential Information.

Obtain THC’s prior written consent to disclose or allow access to any portion of the Confidential Information to any person, other than Authorized Users, Workforce or Subcontractors of Contractor who have completed training in confidentiality, privacy, security and the importance of promptly reporting any Breach to Contractor's management and as permitted in Section 3.01(A)(3), above. Contractor shall produce evidence of completed training to THC upon request. THC, at its election, may assist Contractor in training and education on specific or unique THC processes, systems and/or requirements.

All of Contractor’s Authorized Users, Workforce and Subcontractors with access to a state computer system or database will complete a cybersecurity training program certified under Texas Government Code Section

2054.519 by the Texas Department of Information Resources.

Establish, implement and maintain appropriate sanctions against any member of its Workforce or Subcontractor who fails to comply with this DUA, the Contract or applicable law. Contractor shall maintain evidence of sanctions and produce it to THC upon request.

Obtain prior written approval of THC, to disclose or provide access to any Confidential Information on the basis that such act is Required by Law, so that THC may have the opportunity to object to the disclosure or access and seek appropriate relief. If THC objects to such disclosure or access, Contractor shall refrain from disclosing or providing access to the Confidential Information until THC has exhausted all alternatives for relief.

Certify that its Authorized Users each have a demonstrated need to know and have access to Confidential Information solely to the minimum extent necessary to accomplish the Authorized Purpose and that each has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information contained in this DUA. Contractor and its Subcontractors shall maintain at all times an updated, complete, accurate list of Authorized Users and supply it to THC upon request.

Provide, and require its Subcontractors and agents to provide, to THC periodic written confirmation of compliance with controls and the terms and conditions of this DUA.

THE REMAINDER OF THIS PAGE INTENTIONALLY LEFT BLANK.

THC Solicitation No. 808-26-253551 Page 4 of 10

Return to THC or Destroy, at THC’s election and at Contractor’s expense, all Confidential Information received from THC or created or maintained by Contractor or any of Contractor’s agents or Subcontractors on THC’s behalf upon the termination or expiration of this DUA, if reasonably feasible and permitted by law. See NIST 800-88 and DoD 5220.22-M for applicable electronic media sanitation standards. Contractor shall certify in writing to THC that all such Confidential Information has been Destroyed or returned to THC, and that Contractor and its agents and Subcontractors have retained no copies thereof.

Notwithstanding the foregoing, Contractor acknowledges and agrees that it may not Destroy any Confidential Information if federal or state law, or THC record retention policy or a litigation hold notice prohibits such Destruction. If such return or Destruction is not reasonably feasible, or is impermissible by law, Contractor shall immediately notify THC of the reasons such return or Destruction is not feasible and agree to extend the protections of this DUA to the Confidential Information for as long as Contractor maintains such Confidential Information.

Only conduct secure transmissions of Confidential Information whether in paper, oral, or electronic form. A secure transmission of electronic Confidential Information in motion includes Secure File Transfer Protocol (SFTP) or encryption at an appropriate level as required by rule, regulation or law. Current transport encryption industry standard is Transport Layer Security (TLS) 1.2 or 1.3, Secure Shell (SSH), or Secure Copy Protocol (SCP) and/or Advanced Encryption Standard (AES) 256 bit for file level encryption (both can be used simultaneously). Confidential Information at rest requires encryption unless there is adequate administrative, technical, and physical security as required by rule, regulation or law. All electronic data transfer and communications of Confidential Information shall be through secure systems. Contractor shall provide proof of system, media or device security and/or encryption to THC no later than 48 hours after THC’s written request in response to a compliance investigation, audit, or the Discovery of a Breach.

THC may also request production of proof of security at other times as necessary to satisfy state and federal monitoring requirements. De-identification of Confidential Information in accordance with HIPAA de-identification standards is deemed secure.

Designate and identify a person or persons, as Privacy Official and Information Security Official, each of whom is authorized to act on Contractor’s behalf and is responsible for the development and implementation of this DUA’s privacy and security requirements. Contractor shall provide name and address, phone number, and e-mail address for such designated officials to THC upon execution of this DUA and prior to any change. Upon written notice from THC, Contractor shall promptly remove and replace such official(s) if such official(s) is not performing required functions.

Make available to THC any information THC requires to fulfill THC’s obligations to provide access to, or copies of, Confidential Information in accordance with applicable laws, regulations, or demands of a regulatory authority relating to Confidential Information. Contractor shall provide such information in a time and manner reasonably agreed upon or as designated by applicable laws or regulatory authority.

Comply with the following laws and standards if applicable to the type of Confidential Information and Contractor’s Authorized Purpose:

• Title 1, Part 10, Chapter 202, Subchapter B, Texas Administrative Code

• The Privacy Act of 1974

• OMB Memorandum 17-12

• The Federal Information Security Management Act of 2002 (FISMA)

• Internal Revenue Publication 1075, which is Tax Information Security Guidelines for Federal, State and Local Agencies

• Family Educational Rights and Privacy Act

• National Institute of Standards and Technology (NIST) Special Publications:

THC Solicitation No. 808-26-253551 Page 5 of 10 o NIST Special Publications 800-66 Revision 1, an Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule o NIST Special Publications 800-53 and 800-53A, Recommended Security Controls for Federal Information Systems and Organizations, as currently revised o NIST Special Publication 800-47, a Security Guide for Interconnecting IT Systems o NIST Special Publication 800-88, Guidelines for Media Sanitization;

o NIST Special Publication 800-111, a Guide to Storage of Encryption Technologies for End User Devices containing Protected Health Information (PHI)

• Texas State Archeological Data Confidentiality Laws:

o Texas Government Code § 442.007(f) (information related to State Archeological Program) o Texas Natural Resource Code § 191.004 (Certain Records Not Public Information) o Texas Administrative Code Title 13, Part 2, Chapter 24, Rule 24.13 (Restricted Information)

• Federal Archeological Data Confidentiality Laws:

o Archaeological Resource Protection Act (ARPA) (16 USC § 470hh) (Confidentiality of Information Concerning Nature and Location of Archaeological Resources) o National Historic Preservation Act (NHPA) (16 USC § 470w-3) (Access to Information)

• Restricted Cultural Resource Information (RCRI) Categories:

o Archeological survey site location and record information that contains location descriptions, coordinate data, or spatial imagery allowing an individual to identify archeological site’s location.

o The address or site location of historic structures or other nonarcheological cultural resources nominated for or listed in the National Register of Historic Places or registered as State Archeological Landmarks, if the property owner has specifically requested that such information not be distributed to the general public.

o The site location of cemeteries determined by THC to be at risk of harm.

• Chapter 521, Texas Business and Commerce Code

• Any other State or Federal law, regulation, or administrative rule relating to the specific THC program area that Contractor supports on behalf of THC

Be permitted to use or disclose Confidential Information for the proper management and administration of Contractor or to carry out Contractor’s legal responsibilities, except as otherwise limited by this DUA, the Contract, or law applicable to the Confidential Information, if:

• Disclosure is Required by Law

• Contractor obtains reasonable assurances from the person to whom the information is disclosed that the person shall:

o Maintain confidentiality of Confidential Information in accordance with this DUA o Use or further disclose the information only as Required by Law or for the Authorized

Purpose for which it was disclosed to the person o Notify Contractor in accordance with Section 4.01 of a Breach of Confidential Information that the person Discovers or should have Discovered with the exercise of reasonable diligence

THC Solicitation No. 808-26-253551 Page 6 of 10

3.2. With respect to all Confidential Information, Contractor shall not:

Attempt to reidentify or further identify Confidential Information that has been deidentified, or attempt to contact any persons whose records are contained in the Confidential Information, except for an Authorized Purpose, without express written authorization from THC.

Engage in prohibited marketing or sale of Confidential Information.

Permit, or enter into any agreement with a Subcontractor to, create, receive, maintain, use, disclose, have access to or transmit Confidential Information, on behalf of THC without requiring that Subcontractor to first execute the Form Subcontractor Agreement, Attachment E-1, or Contractor’s own Subcontractor agreement that ensures that the Subcontractor shall comply with the same safeguards and restrictions contained in this DUA for Confidential Information. Contractor is directly responsible for its Subcontractors’ compliance with, and enforcement of, this DUA.

4. Breach Notice, Reporting, and Correction Requirements

4.1. Cooperation and Financial Responsibility.

Contractor shall, at Contractor’s expense, cooperate fully with THC in investigating, mitigating to the extent practicable, and issuing notifications as directed by THC, for any Breach of Confidential Information.

Contractor shall make applicable Confidential Information in Contractor’s possession available pursuant to the requirements of HIPAA or other applicable law upon a determination of a Breach.

Contractor’s obligation begins at the Discovery of a Breach and continues as long as related activity continues, until all effects of the Breach are mitigated to THC’s satisfaction (the incident response period).

4.2. Initial Breach Notice.

For federal information obtained from a federal system of records, including Federal Tax Information and Social Security Administration Data (which includes Medicaid and other governmental benefit program Confidential Information), Contractor shall notify THC of the Breach within the first consecutive clock hour of Discovery. The Contract shall specify whether Confidential Information is obtained from a federal system of records.

For all other types of Confidential Information, Contractor shall notify THC of the Breach not more than 24 hours after

Discovery, or in a timeframe otherwise approved by THC in writing. Contractor shall initially report to THC’s Privacy and Security Officers via email at: security-alerts@thc.texas.gov and to the THC division responsible for the Contract. Likewise, THC IT shall also notify DIR within 24 hours of learning of a Confidential Information Breach.

Contractor shall report all information reasonably available to Contractor to THC about the Breach.

Contractor shall provide contact information to THC for Contractor’s single point of contact who will communicate with THC both on and off business hours during the incident response period.

4.3. Third Business Day Written Notice.

No later than 5 p.m. on the third business day after Discovery, or a time within which Discovery reasonably should have been made by Contractor of a Breach of Confidential Information, Contractor shall provide written notification to THC of all reasonably available information about the Breach, and Contractor's investigation, including, to the extent known to Contractor:

The date the Breach occurred.

The date of Contractor’s and, if applicable, Subcontractor’s Discovery.

A brief description of the Breach, including how it occurred and who is responsible (or hypotheses, if not yet determined).

A brief description of Contractor’s investigation and the status of the investigation.

A description of the types and amount of Confidential Information involved.

Identification of and number of all individuals reasonably believed to be affected, including first and last name of the individual and if applicable, the Legally authorized representative, last known address, age, telephone number, and email address if it is a preferred contact method.

mailto:security-alerts@thc.texas.gov

THC Solicitation No. 808-26-253551 Page 7 of 10

Contractor’s initial risk assessment of the Breach demonstrating whether individual or other notices are required by applicable law or this DUA for THC approval, including an analysis of whether there is a low probability of compromise of the Confidential Information or whether any legal exceptions to notification apply.

Contractor’s recommendation for THC’s approval as to the steps individuals and/or Contractor on behalf of individuals, should take to protect the individuals from potential harm, including Contractor’s provision of notifications, credit protection, claims monitoring, and any specific protections for a Legally Authorized Representative to take on behalf of an individual with special capacity or circumstances.

The steps the Contractor has taken to mitigate the harm or potential harm caused (including without limitation the provision of sufficient resources to mitigate).

The steps Contractor has taken, or will take, to prevent or reduce the likelihood of recurrence of a similar Breach.

Identification or description of the Workforce, Subcontractor, persons, or individuals and any law enforcement that may be involved in the Breach.

A reasonable schedule for Contractor to provide regular updates regarding response to the Breach, but no less than every three (3) business days, or as otherwise directed by THC in writing, including information about risk estimations, reporting, notification, if any, mitigation, corrective action, root cause analysis and when such activities are expected to be completed.

Any reasonably available, pertinent information, documents or reports related to a Breach that THC requests following Discovery.

4.4. Investigation, Response and Mitigation.

Contractor shall immediately conduct a full and complete investigation, respond to the Breach, commit necessary and appropriate staff and resources to expeditiously respond, and report as required to THC for incident response purposes and for purposes of THC’s compliance with report and notification requirements, to the satisfaction of THC.

Contractor shall complete or participate in a risk assessment as directed by THC following a Breach, and provide the final assessment, corrective actions and mitigations to THC for review and approve.

Contractor shall fully cooperate with THC to respond to inquiries and/or proceedings by state and federal authorities, persons and/or individuals about the Breach.

Contractor shall fully cooperate with THC's efforts to seek appropriate injunctive relief or otherwise prevent or curtail such Breach, or to recover or protect any Confidential Information, including complying with reasonable corrective action or measures, as specified by THC in a Corrective Action Plan if directed by THC under the Contract.

THC Solicitation No. 808-26-253551 Page 8 of 10

4.5. Breach Notification to Individuals and Reporting to Authorities.

THC may direct Contractor to provide Breach notification to individuals, regulators or third parties, as specified by THC following a Breach.

Contractor must comply with all applicable legal and regulatory requirements in the time, manner, and content of any notification to individuals, regulators, or third parties, or any notice required by other state or federal authorities, including without limitation, notifications required by Texas Business and Commerce Code § 521.053(b) and HIPAA. Notice letters will be in Contractor’s name and on its letterhead, unless THC otherwise directs, and will contain contact information, including name and title of Contractor’s representative, email address and a toll-free phone number, for the individual to obtain more information.

Contractor shall provide THC with draft notifications for THC approval prior to distribution and copies of distributed and approved communications.

Contractor shall have the burden of demonstrating to the satisfaction of THC that any required notification was timely made. If there are delays outside of Contractor's control, Contractor shall provide written documentation to THC of the reasons for the delay.

If THC directs Contractor to provide notifications, THC shall, in the time and manner reasonably requested by Contractor, cooperate and assist with Contractor’s information requests in order to make such notifications.

5. General Provisions General Provisions to this DUA include the following:

5.1. Ownership of Confidential Information. Contractor acknowledges and agrees that the Confidential Information is and shall remain the property of THC. Contractor agrees it acquires no title or rights to the Confidential Information.

5.2. THC Commitment and Obligations. THC will not request Contractor to create, maintain, transmit, use or disclose PHI in any manner that would not be permissible under applicable law if done by THC.

5.3. THC Right to Inspection. At any time upon reasonable notice to Contractor, or if THC determines that Contractor has violated this DUA, THC, directly or through its agent, will have the right to inspect the facilities, systems, books and records of Contractor to monitor compliance with this DUA. For purposes of this subsection, THC’s agent(s) include, without limitation, the THC Office of the Inspector General, the Office of the Attorney General of Texas, the State Auditor’s Office, outside consultants, legal counsel or other designee.

5.4. Term, DUA Termination, and Survival. DUA will be effective on the date when Contractor executes the Contract and will survive upon Contract termination to maintain Confidential Information after the Contract has expired as set forth herein. If the Contract is extended, this DUA is extended to run concurrent with the Contract.

If THC finds Contractor has violated a material term of this DUA; THC may in its sole discretion:

• Exercise any of its rights including but not limited to reports, access and inspection under this DUA and/or the Contract;

• Require Contractor to submit to a corrective action plan, including a plan for monitoring and plan for reporting as THC may determine necessary to maintain compliance with this DUA;

• Provide Contractor with a reasonable period to cure the violation as determined by THC; or

• Terminate the DUA and Contract immediately and seek relief in a court of competent jurisdiction in Travis County, Texas.

• Before exercising any of these options, THC will provide written notice to Contractor describing the violation and the action THC intends to take.

If neither termination nor cure is feasible, THC shall report the violation to the applicable regulatory authorities.

The duties of Contractor or its Subcontractor under this DUA survive the expiration or termination of this DUA until all the Confidential Information is Destroyed or returned to THC, as required by this DUA.

THC Solicitation No. 808-26-253551 Page 9 of 10

5.5. Injunctive Relief.

Contractor acknowledges and agrees that THC may suffer irreparable injury if Contractor or its Subcontractor fails to comply with any of this DUA terms regarding the Confidential Information or a provision of HIPAA or other laws or regulations applicable to Confidential Information.

Contractor further agrees that monetary damages may be inadequate to compensate THC for Contractor’s or its Subcontractor’s failure to comply. Accordingly, Contractor agrees that THC will, in addition to any other remedies available to it at law or in equity, be entitled to seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages, to enforce the terms of this

DUA.

5.6. Indemnification.

Contractor shall indemnify, defend and hold harmless THC and its respective Executive Commissioner, employees, Subcontractors, agents (including other state agencies acting on behalf of THC) or other members of THC’s Workforce (each of the foregoing hereinafter referred to as “Indemnified Party”) against all actual and direct losses suffered by the Indemnified Party and all liability to third parties arising from or in connection with any breach of this DUA or from any acts or omissions related to this DUA by Contractor or its employees, directors, officers, Subcontractors, or agents or other members of Contractor’s Workforce. The duty to indemnify, defend and hold harmless is independent of the duty to insure. Upon demand, Contractor shall reimburse THC for any and all losses, liabilities, lost profits, fines, penalties, costs or expenses (including costs of required notices, investigation, and mitigation of a Breach, fines or penalties imposed on an Indemnified Party by a regulatory authority, and reasonable attorneys’ fees) which may be imposed upon any Indemnified Party to the extent caused by and which results from the Contractor’s failure to meet any of its obligations under this DUA. Contractor’s obligation to defend, indemnify and hold harmless any Indemnified Party will survive the expiration or termination of this DUA.

5.7. Insurance.

In addition to any insurance required in the Contract, at THC’s option, THC may require Contractor to maintain, at its expense, the special and/or custom first- and third-party insurance coverages, including without limitation data breach, cyber liability, crime theft and notification expense coverages, with policy limits sufficient to cover any liability arising under this DUA, naming the State of Texas, acting through THC, as an additional named insured and loss payee, with primary and noncontributory status.

Contractor shall provide THC with written proof that required insurance coverage is in effect, at the request of THC.

5.8. Entirety of the Contract.

This DUA is incorporated by reference into the Contract and, together with the Contract, constitutes the entire agreement between the parties. No change, waiver, or discharge of obligations arising under those documents will be valid unless in writing and executed by the party against whom such change, waiver, or discharge is sought to be enforced.

5.9. Automatic Amendment and Interpretation.

Upon the effective date of any amendment or issuance of additional regulations to any law applicable to Confidential Information, this DUA will automatically be amended so that the obligations imposed on THC and/or Contractor remain in compliance with such requirements. Any ambiguity in this DUA will be resolved in favor of a meaning that permits THC and Contractor to comply with laws applicable to Confidential Information.

5.10. Notices and Approval Requests.

All notices and requests for approval related to this DUA must be directed to security-alerts@thc.texas.gov.

mailto:security-alerts@thc.texas.gov

THC Solicitation No. 808-26-253551 Page 10 of 10

EXHIBIT XI-1

SUBCONTRACTOR AGREEMENT FORM

The DUA between THC and Contractor establishes the permitted and required uses and disclosures of Confidential Information by Contractor.

Contractor has subcontracted with (Subcontractor) for performance of duties on behalf of CONTRACTOR which are subject to the DUA. Subcontractor acknowledges, understands and agrees to be bound by the same terms and conditions applicable to Contractor under the DUA, incorporated by reference in this Agreement, with respect to THC Confidential Information. Contractor and Subcontractor agree that THC is a third-party beneficiary to applicable provisions of the subcontract.

THC has the right, but not the obligation, to review or approve the terms and conditions of the subcontract by virtue of this Subcontractor Agreement Form. Contractor and Subcontractor assure THC that any Breach as defined by the DUA that Subcontractor Discovers shall be reported to THC by Contractor in the time and manner, including all content, as required by the DUA.

If Contractor knows or should have known in the exercise of reasonable diligence of a pattern of activity or practice by Subcontractor that constitutes a material breach or violation of the DUA or the Subcontractor’s obligations, Contractor shall:

• Take reasonable steps to cure the violation or end the violation, as applicable

• If the steps are unsuccessful, terminate the contract or arrangement with Subcontractor, if feasible

• Notify THC immediately upon Discovery of the pattern of activity or practice of Subcontractor that constitutes a material breach or violation of the DUA and keep THC reasonably and regularly informed about steps Contractor is taking to cure or end the violation or terminate Subcontractor’s contract or arrangement

This Subcontractor Agreement Form is executed by the parties in their capacities indicated below.

Contractor Subcontractor

By: By:

Name: Name:

Title: Title

Date: Date: