Exhibit D - Privacy Addendum.docx

PRIVACY AND SECURITY REQUIREMENTS

A. Purpose of Exhibit

1. This Exhibit sets forth the privacy and security requirements that apply to all Personally Identifiable Information (PII) that Contractor obtains, maintains, transmits, uses or discloses from Covered California pursuant to this Agreement.

2. The parties agree to all terms and conditions of this Exhibit in order to ensure the integrity, security, and confidentiality of the information exchanged pursuant to this Agreement, and to allow disclosure and use of such information only as permitted by law and only to the extent necessary to perform functions and activities pursuant to this Agreement.

3. This Exhibit establishes requirements in accordance with applicable federal and state privacy and security laws including, but not limited to, the Information Practices Act (California Civil Code Section 1798 et seq.), the federal Patient Protection and Affordable Care Act (P.L. 111-148), as amended by the federal Health Care and Education Reconciliation Act of 2010 (P.L. 111-152) (herein, the “Affordable Care Act”), and its implementing regulations at 45 C.F.R. Sections 155.260 and 155.280 (the “Exchange Privacy and Security Rules”) and, where applicable, the Health Insurance Portability and Accountability Act (42 U.S.C. Section 1320d-d8) and the Health Information Technology for Economic and Clinical Health Act and their implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, “HIPAA”), as well as applicable privacy and security control protocols set forth within the Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE).

B. Definitions The following definitions shall apply to this Exhibit:

1. Breach: Shall mean a confirmed “breach of the security of the system” as such term is specifically-defined within the CA Information Practices Act [CA Civ. Code §1798.29(f)].

2. Disclosure: The release, transfer, provision of access to, or divulging in any other manner of PII outside the entity holding the information. For purposes of this Exhibit, disclosure includes if a person or entity outside of the entity holding the information takes possession or control of PII, such as if PII is encrypted by an unauthorized person as the result of a ransomware attack.

3. Personal Information or PI: Information that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual [CA Civ. Code §1798.3].

4. Personally Identifiable Information or PII: Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. (OMB M-07-16.) PII includes Personal Information (PI) and Protected Health Information (PHI).

5. Protected Health Information or PHI: Individually Identifiable Health Information that is transmitted by electronic media, maintained in electronic media, or is transmitted or maintained in any other form or medium, as defined in 45 C.F.R. Section 160.103.

6. Privacy Incident: shall mean either: i) the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to PII, whether physical, or electronic; or ii) a reasonable belief that unauthorized acquisition of PII that compromises the security, confidentiality or integrity of the PII has occurred

7. Security Incident: The act of violating an explicit or implied security policy, which includes attempts (either failed or successful) to gain unauthorized access to a system or its data, unwanted disruption or denial of service, the unauthorized use of a system for the processing or storage of data; and changes to system hardware, firmware, or software characteristics without the owner's knowledge, instruction, or consent. Incidents include the loss of data through theft or device misplacement, loss or misplacement of hardcopy documents, and misrouting of mail, all of which may have the potential to put the data at risk of unauthorized access, use, disclosure, modification, or destruction. Adverse events such as floods, fires, electrical outages, and excessive heat are not considered incidents. (Computer Matching Agreement, Agreement No. 2013-11, p.5.)

C. Applicable Laws Contractor shall comply with any and all federal and state privacy and security laws, as well as applicable rules and regulations pertaining to Covered California including, but not limited to, those arising under the federal Patient Protection and Affordable Care Act and its implementing regulations. To the extent a conflict arises between any laws or other requirements, Contractor agrees to comply with the applicable requirements imposing the more stringent privacy and security standards.

1. Exchange Privacy and Security Rules (45 C.F.R. Section 155.260).

a. In accessing, collecting, using or disclosing PII in performing functions for Covered California as authorized by this Agreement, Contractor shall only use or disclose PII to the minimum extent such information is necessary to perform such functions.

b. Contractor shall establish and implement privacy and security standards that are consistent with the principles of 45 C.F.R. Section 155.260(a)(3) as set forth below in subsections (i) through (viii):

i. Individual access. Individuals shall be provided with a simple and timely means to access and obtain their PII in a readable form and format;

ii. Correction. Individuals shall be provided with a timely means to dispute the accuracy or integrity of their PII and to have erroneous information corrected or to have a dispute documented if their requests are denied;

iii. Openness and transparency. Contractor shall be open and transparent regarding its policies, procedures, and technologies that directly affect individuals and/or their PII;

iv. Individual choice. Individuals shall be provided a reasonable opportunity and capability to make informed decisions about the collection, use, and disclosure of their PII;

v. Collection, use and disclosure limitations. PII shall be created, collected, used, and/or disclosed only to the extent necessary to accomplish a specified purpose(s) and never to discriminate inappropriately;

vi. Data quality and integrity. Contractor will take reasonable steps to ensure that PII is complete, accurate, and up-to-date to the extent necessary for Contractor’s intended purposes and has not been altered or destroyed in an unauthorized manner;

vii. Safeguards. PII will be protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure; and,

viii. Accountability. Contractor will use appropriate monitoring and other means and methods to assure accountability with these principles and to report and mitigate non-adherence and breaches.

2. California Information Practices Act. Contractor shall comply with the applicable privacy and security provisions of the Information Practices Act of 1977, California Civil Code Section 1798 et seq. and shall provide assistance to Covered California as may be reasonably necessary for Covered California to comply with these provisions [CA Civ. Code §1798].

3. Health Insurance Portability and Accountability Act (“HIPAA”).

a. Contractor expressly acknowledges and agrees that Covered California is not a health care provider, a health care plan, or a health care clearinghouse. Accordingly, the parties mutually acknowledge and agree that, for purposes of this Agreement, Covered California is not a Covered Entity as such term is specifically defined in HIPAA.

b. Contractor expressly acknowledges and agrees that where Covered California performs a function required under applicable law pursuant to 45 C.F.R. Section 155.200, it is not acting as a Business Associate of any other Covered Entity and Contractor is not acting as Covered California’s Business Associate, as such terms are specifically defined in HIPAA. Should Covered California determine Contractor to be a Covered Entity or Business Associate as specifically-defined within HIPAA, Contractor shall at all times comply with applicable privacy and information security obligations imposed under HIPAA pertaining to any PII subject to this Agreement.

4. Fingerprinting and Background Checks. (CA Gov. Code Section 1043).

a. Before any individual who provides services related to this Agreement may access PII, including but not limited to any employee, subcontractor or other person, Contractor must ensure that any such individual shall agree to a criminal background check, which shall be conducted by Covered California in accordance with California Government Code Section 1043, and its implementing regulations set forth in California Code of Regulations, Title 10, Section 6456. Fees charged by the California Department of Justice for the cost of processing such requests shall be paid by Contractor.

b. Background check records shall be maintained by Covered California for so long as any such individual is employed with Contractor or, if applicable, Contractor’s subcontractor plus a period of no less than five (5) years thereafter. Contractor shall provide Covered California with a list of any such individuals subject to this requirement and shall provide, update and notify Covered California of any personnel changes involving any such individuals via e-mail at backgroundchecks@covered.ca.gov.

c. For any insurance agent licensed by the California Department of Insurance (CDI) Covered California may obtain a criminal history check in accordance with Government Code Section 1043 from CDI.

5. Privacy and Security Awareness Training

a. Contractor shall ensure that any and all employees, agents, representatives or subcontractors who are provided access to PII have been provided privacy and security awareness training prior to accessing PII.

b. Contractor shall provide annual privacy and security awareness training to the aforementioned individuals no less than once per year thereafter.

c. Contractor shall likewise ensure that any and all such employees, agents, representatives or subcontractors certify in writing their completion of any such privacy and security awareness programs and, upon request, shall provide Covered California with copies of the same.

d. Contractor shall retain the aforementioned certifications for a period of five (5) years and shall provide the copies upon request during this time.

e. Upon reasonable request by Covered California, Contractor shall ensure that the aforementioned individuals subject to the above-referenced training requirements are enrolled in and participate in privacy and security awareness training provided by Covered California. Privacy and security awareness training provided by Covered CA shall be provided in an online format, free-of-charge and, upon reasonable request, Contractor shall cooperate in good-faith with Covered California to ensure that any such individuals are provided access.

f. Notwithstanding the foregoing, Contractor shall be deemed to have complied with the above-referenced requirements through the completion of any certification program which includes privacy and security awareness training and is required for Contractor’s participation in Covered California.

D. Consumer Rights

1. Accounting of Disclosures

a. Contractor shall assist Covered California in responding to accounting requests by individuals that are made to Covered California under the Information Practices Act (Civil Code Section 1798.25-29) and if Protected Health Information is involved, pursuant to HIPAA, 45 C.F.R. Section 164.528.

b. The obligation of Contractor to provide an accounting of disclosures as set forth herein survives the expiration or termination of this Agreement with respect to accounting requests made after such expiration or termination.

2. Copies of Records Requests Regardless of whether a request is made to Covered California or to Contractor, Contractor shall respond to the request with respect to the record Contractor and its subcontractors maintain, if any, in a manner and time frame consistent with requirements specified in the Information Practices Act (Civil Code Sections 1798.30-1798.34) and if Protected Health Information is involved, with HIPAA (45 C.F.R Section 164.524).

3. Requests to Amend Records

a. Contractor shall make any amendments to Personally Identifiable Information in a record that Covered California directs or agrees to, whether at the request of Covered California or an Individual.

b. Regardless of whether a request to amend records is made to Covered California or to Contractor, Contractor shall respond to the request with respect to the record Contractor and its subcontractors maintain in a manner and time frame consistent with requirements specified in the Information Practices Act (Civil Code Section 1798.35) and if Protected Health Information is involved, with HIPAA (45 C.F.R. Section 164.526).

4. Requests to Restrict Use and Disclosure of Personally Identifiable Information

a. Contractor shall reasonably comply with any requests to restrict the use and disclosure of Personally Identifiable Information.

b. If Protected Health Information is involved, Contractor shall respond to the request in a manner and time frame consistent with requirements specified in HIPAA (45 C.F.R. Section 164.522).

5. Confidential Communications Request

a. Upon receipt of written notice, Contractor shall reasonably comply with any requests to utilize an alternate address, email, or telephone number when communicating with the individual.

b. If the request is denied, a written response shall be sent to the individual stating the reasons for denying the request.

c. If Protected Health Information is involved, regardless of whether a request is made to Covered California or to Contractor, Contractor shall respond to the request in a manner and time frame consistent with requirements specified in HIPAA (45 C.F.R. Section 164.522(b)(1)).

6. In responding to any requests from individuals, Contractor shall verify the identity of the person making the request to ensure that the person is the individual who is the subject of the PII or has authority to make requests concerning the PII before responding to the request.

7. In the event any individual submits any of these requests directly from the Contractor, Contractor shall within five (5) calendar days forward such request to Covered California.

E. General Safeguards and Security Controls

1. Contractor shall establish and implement operational, technical, administrative and physical safeguards that are consistent with any applicable laws to ensure:

a. The confidentiality, integrity, and availability of PII created, collected, used, and/or disclosed by the Exchange;

b. PII is only used by, or disclosed to, those authorized to receive or view it;

c. PII is protected against any reasonably anticipated threats or hazards to the confidentiality, integrity, and availability of such information;

d. PII is protected against any reasonably anticipated uses or disclosures of such information that are not permitted or required by law; and

e. PII is securely destroyed or disposed of in an appropriate and reasonable manner and in accordance with the agreed upon retention schedules.

f. Paper PII is protected as follows:

i. PII in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information. PII in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.

ii. Visitors to areas where PII is contained shall be escorted and PII shall be kept out of sight while visitors are in the area.

iii. PII must be disposed of through confidential means, such as crosscut shredding and pulverizing in accordance with Covered California secure document destruction protocols.

iv. PII must not be removed from the premises of the Contractor except with express written permission of the Exchange.

v. Faxes containing PII shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending the fax.

vi. Mailings of PII shall be sealed and secured from damage or inappropriate viewing of PII to the extent possible. Mailings which include 500 or more individually identifiable records of PII in a single package shall be sent using a tracked mailing method which includes verification of delivery and receipt, unless the prior written permission of the Covered California to use another method is obtained.

2. Privacy and Information Security Programs

a. Covered California is required to maintain compliance with the current version of the privacy and security safeguards for health benefit exchanges, ARC-AMPE, mandated by the Centers for Medicare & Medicaid Services (CMS). Contractor is required to maintain privacy and information security programs that meet or exceed ARC-AMPE privacy and security controls through programs based on the National Institute of Standards and Technology Special Publication (NIST SP) 800-53 Rev. 5 framework, or comparable, which must at all times govern Contractor’s access, use, and storage of PII disclosed to Contractor under this Agreement.

3. Access Requirements

a. If Contractor requires direct access to Covered California systems, Contractor must agree to the following:

i. Contractors are required to use only devices issued by Covered California to access its systems unless explicit consent is given for an exception.

ii. Devices issued by Covered California must connect to the internet for at least 24 hours once per week to receive necessary security updates.

iii. Each Contractor employee, agent, or independent contractor must agree to Covered California's Acceptable Use Policy before gaining access to its systems.

iv. Contractors must notify Covered California immediately of any confirmed or suspected security incident identified while delivering services.

v. Contractor must notify Covered California within one (1) hour if an employee or agent no longer requires access to its systems.

vi. Contractor must maintain and store all PII within Covered California systems. Transferring any Covered California PII to Contractor’s systems is prohibited unless explicit consent from Covered California is given for an exception.

vii. Upon termination or completion of this Agreement, Contractors agree to return all Covered California equipment in working condition.

F. Single Point of Contact

1. Contractor shall designate one (1) individual to serve as the single point of contact (“SPOC”) in matters pertaining to Contractor’s information security and privacy program and the implementation of the requirements set forth herein. The name and contract information of the aforementioned SPOC shall be submitted to the Covered California Information Security and Privacy Offices via e-mail at, respectively:

informationsecurity@covered.ca.gov; and privacyofficer@covered.ca.gov no later than sixty (60) days following the Effective Date of this Agreement.

2. The SPOC may, in his or her discretion, delegate project-related tasks to other individuals but shall at all times remain responsible for ensuring compliance with the security and privacy-related requirements specified within this Agreement and for communicating with the Covered California Information Security and Privacy Offices in security and privacy-related matters.

G. Policies and Procedures

1. Contractor shall implement and maintain written policies and procedures to ensure the privacy and security of PII stored, maintained, or accessed in compliance with this agreement and any applicable laws. Such policies shall address:

a. The implementation of consumer rights as required by this Exhibit;

b. Reasonable safeguards as required by this Exhibit;

c. Contractor’s processes for monitoring, periodically assessing, and updating security controls to ensure the continued effectiveness of those controls; and

d. The training of Contractor’s employees, agents and subcontractors.

2. Upon request, Contractor shall provide Covered California with copies of any such policies and procedures adopted by Contractor to meet its obligations under this Agreement. Should Covered California determine any such policies and procedures to be insufficient, Contractor agrees to cooperate in good faith to incorporate appropriate revisions required by Covered California to bring any such policies and procedures into compliance.

3. Contractor agrees to apply appropriate sanctions against any of its workforce members who fail to comply with its privacy policies and procedures or the provisions specified herein.

H. Subcontractors

1. Contractor shall be bound by and be responsible for the acts and omissions of its subcontractors, agents or vendors in the exchange of data with the Exchange. Contractor shall take reasonable steps to ensure compliance with the terms of this Agreement by any such individuals.

2. Contractor agrees to enter into written contracts with its agents and contractors that obligate such agents or subcontractors to abide by the same privacy and security standards and obligations that Contractor has agreed to in this Agreement.

3. Upon reasonable request by Covered California, Contractor shall provide copies of any written agreements or contracts entered into between Contractor and its agents or subcontractors to fulfill the privacy and security-related obligations specified herein.

I. Privacy & Security Incidents; Breaches

1. Contractor shall immediately report to the Covered California Privacy Officer at PrivacyOfficer@covered.ca.gov any actual or suspected Privacy or Security Incidents involving PII created or received under this Agreement. Contractor’s report (“Initial Report”) shall be provided on that certain Privacy & Incident Intake Form, developed by the Covered California Privacy Office, which is incorporated herein by reference and located at the end of this Exhibit. Contractor’s Initial Report shall, to the maximum extent possible, include the following information to the extent it is known at that time:

a. A brief description of what happened including the date of the incident and the date of the discovery of the incident;

b. The names or identification numbers of the individuals whose PII has been, or is reasonably believed to have been accessed, acquired, used or disclosed

c. A description of the types of PII that were involved in the incident, as applicable;

d. Information regarding any information system intrusion and any systems potentially compromised; and

e. Any other information necessary for Covered California to conduct an investigation and include in notifications to the individual(s) or relevant regulatory authorities under applicable privacy and security requirements.

2. Following the submission of its Initial Report, Contractor shall immediately commence an investigation in accordance with applicable law to:

a. Determine the scope of the incident;

b. Mitigate harm that may result from the incident; and

c. Restore the security of the system to prevent any further harm or incidents.

3. Contractor shall cooperate with Covered California in investigating the actual or suspected incident and in meeting Covered California’s obligations, if any, under applicable laws. This includes providing ongoing updates regarding Contractor’s investigation, mitigation, and remediation efforts as more information becomes available or as reasonably requested by Covered California.

4. Unless an extension is granted by Covered California, Contractor will prepare and submit a follow-up report (“Final Report”) within 15 days of submitting its Initial Report. Contractor’s Final Report shall be submitted to the Covered California Privacy Office on the same Privacy & Security Incident Intake Form used for the submission of Covered California’s Initial Report

5. Within its Final Report, Contractor shall describe the results of its investigation, as well as any facts uncovered through the same. Contractor shall make any and all reasonable efforts to obtain the information requested within the Privacy & Security Incident Intake Form and shall provide an explanation if any information requested cannot be obtained.

6. Contractor’s Final Report shall likewise include a corrective action plan which describes the steps to be taken to prevent any future reoccurrence of the incident.

7. Contractor shall cooperate with Covered California in developing content for any public statements and shall not give any public statements regarding any Privacy or Security Incident involving Covered California enrollees without the express written permission of Covered California.

8. If the Privacy Incident is determined to have resulted in a Breach attributable to Contractor or its agents or subcontractors, Contractor shall:

a. Be fully responsible for providing breach notifications to consumers as required under applicable laws;

b. Pay any costs associated with any such Breach notifications as well as any costs or damages associated with the incident; and

c. Should Covered California in its sole discretion determine that credit monitoring is an appropriate remedy, arrange for and bear the reasonable, out-of-pocket cost of providing to each such affected individual one (1) year of credit monitoring services from a nationally recognized supplier of such services.

9. If Contractor determines that a Privacy Incident has not resulted in a Breach, it shall document its assessment and provide such documentation to Covered California within one week of completing its final report. Notwithstanding the foregoing, Covered California reserves the right to reject Contractor’s assessment and direct Contractor to treat the incident as a Breach.

J. Risk Classification & Assessment

1. Covered California may, in its discretion, assign a tier-based risk classification to the disclosure of PII to Contractor under this Agreement.

2. Determinations as to Contractor’s risk-classification tier shall be made by Covered CA in its sole discretion and Contractor shall be notified of Contractor’s risk-classification prior to the execution of this Agreement and during this Agreement if it changes. Contractor’s risk-classification tier shall be provided to the SPOC appointed by Contractor within Para. F above.

3. Based on the applicable risk-classification, Contractor acknowledges and agrees that Covered California may impose additional privacy and information security-related obligations, which may include but need not be limited to annual attestations, annual security assessments, or a requirement to carry cyber liability insurance.

a. If Covered California requires Contractor to carry cyber liability insurance, the terms related to such insurance will be contained within Exhibit C of the underlying Agreement.

4. Contractor shall at all times cooperate in good faith with Covered California in the provision of any information needed by Covered California to ascertain Contractor’s risk classification or the above-referenced security-related documentation.

K. Right to Inspect Covered California may inspect the facilities, systems, books, and records of Contractor to monitor compliance with this Exhibit at any time. Contractor shall promptly remedy any violation reported to it by Covered California and shall certify the same to the Covered California Privacy Officer in writing. The fact that Covered California inspects, fails to inspect, fails to detect violations of this Exhibit or detects but fails to notify Contractor of the violation or require remediation is not a waiver of Covered California’s rights under this Agreement and this Exhibit.

L. Indemnification Contractor agrees to indemnify, defend, and save harmless Covered California, its officers, trustees, agents, and employees from any and all claims, losses, costs, liabilities, damages, and deficiencies, including interest, penalties, attorneys’ fees, breach notification costs to affected individuals, costs for appropriate identity theft prevention and mitigation services, costs for a call center to the extent necessary to respond to affected individuals, costs for restoration of services, costs to retain an alternative contractor where necessary to maintain the availability of services, and any other costs Covered California determines to be reasonable, which arise out of or are due to, or are alleged to arise out of or due to, any of the following:

1. Contractor’s or its subcontractor’s or agent’s failure to comply with the requirements of this Agreement which results in a Breach, as defined in this Exhibit.

1. Use or disclosure of PII by Contractor or its subcontractors or agents that is not permitted by this Agreement.

1. Contractor’s or its subcontractor’s or agent’s failure to comply with the requirements of this Agreement which results in a Security Incident, as defined in this Exhibit.

If Contractor or its subcontractor or agent publishes or discloses PII in violation of this Agreement, Covered California shall additionally be entitled to injunctive relief, or any other remedies to which it is entitled under law or equity, without posting a bond.

The above-referenced indemnification shall be subject to the indemnification procedural requirements set forth in Section E of Exhibit C.

M. Termination of Agreement

1. If Contractor breaches its obligations under this Exhibit as determined by Covered California, Covered California may, at its option:

a. Require Contractor to submit to a plan of monitoring and reporting, as Covered California may deem necessary to maintain compliance with this Agreement;

b. Provide Contractor with an opportunity to cure the breach; or

c. After giving Contractor an opportunity to cure the breach, or upon breach of a material term of this Exhibit, terminate this Agreement for cause.

d. A failure of Covered California to exercise any of these options shall not constitute a waiver of its rights under this Agreement.

2. Upon completion or termination of this Agreement, Contractor shall promptly return all Covered California devices to Covered California as directed.

If Contractor is a Tier 1 contractor and subject to Covered California’s Exhibit D1, contractor shall either:

a. Return all PII to Covered California or destroy all PII in a manner consistent with applicable State and Federal laws, regulations, and agency guidance on the destruction of PII; and

b. Provide a written attestation confirming that all PII records have been returned to Covered CA or a certificate of destruction confirming the Covered CA PII has been adequately destroyed and completely purged from all Contractor systems.

The format and method of destroying or returning these records must be agreed upon by all parties ensuring that the process meets the security and operational needs of Covered CA.

If return or destruction of PII is not feasible, Contractor shall explain in writing to the Covered California’s Chief Privacy Officer why return or destruction is not feasible. The obligations of Contractor under this Agreement to protect PII and to limit its use or disclosure shall continue and survive until all Covered California devices and PII have either been returned to Covered California or properly destroyed. During any period in which the Contractor continues to possess Covered CA PII, including after termination of this Agreement, Covered CA retains the right to access its data upon request.

Agreement TBD Page 15 of 16 Covered California/TBD

EXHIBIT D

(Standard Agreement) 3.

(V.04.17.2026)

Privacy & Security Incident Intake Report

Submitted By

Location:

Email:

Case Tracking Number (if any):

Incident Number (PO Use Only):

Summary of Incident:

Rev. 4/21 Page 17 of 18

EXHIBIT D

(Standard Agreement)

Privacy & Security Incident Intake Report

Incident Details

Approximate number of individuals impacted:

Please describe the Personally Identifiable Information (PII) involved in the incident. (Example – SSN, DOB, Name):

Who had access or potential access to the PII?

Did the incident impact any Covered California computer/s or network systems? If so, please describe how?

Cause or probable cause of incident:

Have any corrective actions been taken thus far? If so, please describe the actions which have been taken?

Rev. 4/21 Page 18 of 18 image1.jpeg image2.jpeg