TEMPLATE Agreement Attachment 4 DPA.docx

AGREEMENT ATTACHMENT 4

Data Protection Addendum

This Data Protection Addendum (“Addendum”) is entered into as of _______________, by and between _______________________________, (“Selected Firm”) and The Rector and Visitors of the University of Virginia (“UVA” or “University”) (each a “Party” and collectively the “Parties”).

WHEREAS, the Parties have entered into one or more agreements or arrangements (collectively, the “Underlying Agreement(s)”) under which Selected Firm will create, obtain, transmit, use, maintain, process, or dispose of University Data (as defined in the Definitions Section of this Addendum) in order to fulfill its obligations to the University under the Underlying Agreement(s).

WHEREAS, if Selected Firm, through its work with the University, may receive one of the University’s designated “health care components” identified below, will receive, create, or come into non-incidental contact with individually identifiable health information of UVA patients or UVA Health Plan participants -- “Protected Health Information” as that term is defined in regulations under the Health Insurance Portability and Accountability Act of 1996 ( “HIPAA”), at 45 C.F.R. Part 160.103 -- the Business Associate Addendum found at https://suppliers.uvafinance.virginia.edu/resources/business-associate-addendum applies in addition to this Data Protection Addendum. Where noted herein, certain sections of the Business Associate Addendum replace sections of this Data Protection Addendum as regards Protected Health Information (“PHI”).

WHEREAS, this Addendum sets forth the terms and conditions pursuant to which University Data will be protected by Selected Firm during the term of the Parties Underlying Agreement(s) and after its termination.

STANDARD PROVISIONS

1. Definitions

a. “End User” means an individual authorized by the University to access and use the Goods/Services provided by Selected Firm under this Addendum.

b. “Protected University Data” includes all data defined as Highly Sensitive, Sensitive, or Internal Use data in UVA's IRM-003 Data Protection of University Information policy (http://uvapolicy.virginia.edu/policy/IRM-003) that is not intentionally made generally available by the University on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and patient, student, and personnel data.

c. “Securely Destroy” means taking actions that render data written on physical (e.g., hardcopy, microfiche, etc.) or electronic media unrecoverable by both ordinary and extraordinary means. These actions must meet or exceed those sections of the National Institute of Standards and Technology (NIST) SP 800-88, REV 1 guidelines relevant to data categorized as high security.

d. “Security Breach” means the unauthorized access, use or disclosure that compromises or threatens to compromise the confidentiality, integrity, or availability of University Data

e. “Goods/Services” means any goods or services acquired by the University of Virginia from Selected Firm.

f. “University Data” includes Protected University Data and any other information that is created, possessed or used by the University or is intentionally made generally available by the University on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and patient, student, and personnel data.

g. "Audit Trail" means a chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security- relevant transaction from inception to final result.

2. Rights and License in and to the University Data The parties agree that as between them, all rights including all intellectual property rights in and to University Data shall remain the exclusive property of the University, and Selected Firm has a revocable, limited, nonexclusive license to use these data as provided in this Addendum solely for the purpose of performing its obligations hereunder. This Addendum does not give a party any rights, implied or otherwise, to the other’s data, content, or intellectual property, except as expressly stated in the Underlying Agreement and/or this Addendum.

3. Data Privacy

a. Selected Firm will use University Data only for the purpose of fulfilling its duties under the Underlying Agreement and will not share such data with or disclose it to any third party without the prior written consent of the University, except as required by this Addendum or as otherwise required by law.

b. Protected University Data will not be stored outside the United States without prior written consent from the University.

c. Selected Firm will provide access to University Data only to its employees and subcontractors who need to access the data to fulfill Selected Firm obligations under the Underlying Agreement. Selected Firm will ensure that employees who perform work under the Underlying Agreement have read, understood, and received appropriate instruction as to how to comply with the data protection provisions of this Addendum.

d. Selected Firm acknowledges that for the purposes of the Underlying Agreement it will be designated as a “school official” with “legitimate educational interests” in the University education records, as those terms have been defined under FERPA and its implementing regulations, and Selected Firm agrees to abide by the limitations and requirements imposed on school officials. Selected Firm will use the education records only for the purpose of fulfilling its duties under the Underlying Agreement for University’s and its End User’s benefit, and will not share such data with or disclose it to any third party except as provided for in the Underlying Agreement and this Addendum, required by law, or authorized in writing by the University.

4. Data Security, Integrity, and Confidentiality

a. Selected Firm will take reasonable measures, including audit trail, to protect University Data to ensure the integrity and availability of University Data against deterioration or degradation of data quality and authenticity. Selected Firm will be responsible during the terms of the Underlying Agreement, unless otherwise specified elsewhere in this Addendum, for converting and migrating electronic data as often as necessary so that information is not lost due to hardware, software, or media obsolescence or deterioration.

b. Selected Firm will store and process University Data in accordance with commercial best practices, including appropriate administrative, physical, and technical safeguards, and audit trail, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will ensure the confidentiality, integrity and availability of University Data, and be no less protective than those used to secure Selected Firm’s own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved. Without limiting the foregoing, Selected Firm warrants that all electronic University Data will be encrypted in transmission (including via web interface) in accordance with latest version of Federal Information Processing Standards Publication (FIPS) Publication 140-2If Selected Firm stores, transmits, or processes Protected University Data as part of the Underlying Agreement, Selected Firm warrants that the information will be stored in accordance with latest version of National Institute of Standards and Technology Special Publication 800-171 or the International Organization for Standardization and the International Electrotechnical Commission 27002 (ISO/IEC 27002).

c. Selected Firm will use reasonable, appropriate industry-standard and up-to-date security tools and technologies in providing Goods/Services under the Underlying Agreement.

5. Employee Background Checks and Qualifications Selected Firm shall ensure that its employees who will have potential access to University Data have passed reasonable and appropriate background screening and possess the qualifications and training to comply with the terms of this Addendum.

6. Security Breach

a. Response. Upon becoming aware of a Security Breach, or of circumstances that are reasonably understood to suggest an actual or suspected Security Breach of University Data, Selected Firm will immediately notify the University consistent with applicable state or federal laws, fully investigate the incident, and cooperate fully with the University’s investigation of and response to the incident. Except as otherwise required by law, Selected Firm will not provide notice of an actual or suspected Security Breach directly to individuals whose Personally Identifiable Information was involved, regulatory agencies, or other entities, without prior written permission from the University.

b. Liability. If Selected Firm must under the Underlying Agreement create, obtain, transmit, use, maintain, process, or dispose of Protected University Data, the following provisions apply:

1. In addition to any other remedies available to the University under law or equity, Selected Firm will reimburse the University in full for all costs incurred by the University in investigation and remediation of any Security Breach caused by Selected Firm, including but not limited to providing notification to individuals whose Personally Identifiable Information was compromised and to regulatory agencies or other entities as required by law or contract; providing one year’s credit monitoring to the affected individuals if the Protected University Data exposed during the breach could be used to commit financial identity theft; and the payment of legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners as a result of the Security Breach.

2. In addition to any other insurance coverage required by the Underlying Agreement with the University, Selected Firm will for the duration of the term of the Underlying Agreement, maintain at least one million dollars ($1,000,000) Cyber Liability coverage with insurance companies that hold at least an A- financial rating with A.M. Best Company. In no event, should Selected Firm construe these minimum required limits to be their limit of liability to the University.

3. The University must be named as an Additional Insured on the Cyber Liability Insurance, and the proper name is “The Commonwealth of Virginia, and the Rector and Visitors of the University of Virginia, its officers, employees and agents.” Upon the University’s request, Selected Firm will provide a Certificate of Insurance (COI).

7. Response to Legal Orders, Demands or Requests for Data

a. Except as otherwise expressly prohibited by law, Selected Firm will:

1. immediately notify the University of Selected Firm’s receipt of any subpoenas, warrants, or other legal orders, demands or requests seeking University Data;

2. consult with the University regarding its response;

3. cooperate with the University’s reasonable requests in connection with efforts by the University to intervene and quash or modify the legal order, demand or request; and

4. provide the University with a copy of its response.

b. If the University receives a subpoena, warrant, or other legal order, demand or request (including request pursuant to the Virginia Freedom of Information Act) seeking University Data maintained by Selected Firm, the University will promptly provide a copy to Selected Firm. Selected Firm will promptly supply the University with copies of data required for the University to respond in a timely manner, and will cooperate with the University’s reasonable requests in connection with its response.

8. Data Transfer Upon Termination or Expiration

a. Upon termination or expiration of the Underlying Agreement, this Addendum also terminates, and Selected Firm will ensure that all University Data are securely returned or destroyed as directed by the University in its sole discretion. Transfer to the University or a third party designated by the University shall occur within a reasonable period of time, and without significant interruption in service. Selected Firm shall ensure that such transfer/migration uses facilities and methods that are compatible with the relevant systems of the University or its transferee, and to the extent technologically feasible, that the University will have reasonable access to University Data during the transition.

b. Upon termination or expiration of the Underlying Agreement, and after any requested transfer of data, Selected Firm must Securely Destroy all data in its possession and in the possession of any subcontractors or agents to which Selected Firm might have transferred University data. Selected Firm agrees to provide documentation (if available) of data destruction to the University.

c. Selected Firm will notify the University of impending cessation of its business and any contingency plans. This includes immediate transfer of any previously escrowed assets and data and providing the University access to Selected Firm’s facilities to remove and destroy University-owned assets and data. Selected Firm shall implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the University. Selected Firm will also provide a full inventory and configuration of servers, routers, other hardware, and software involved in service delivery along with supporting documentation, indicating which if any of these are owned by or dedicated to the University. Selected Firm will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and effect on the University, all such work to be coordinated and performed in advance of the formal, final transition date.

9. Audits

a. The University reserves the right in its sole discretion to perform audits of Selected Firm at the University’s expense to ensure compliance with the terms of this Addendum. Selected Firm shall reasonably cooperate in the performance of such audits. This provision applies to the Underlying Agreement and all agreements under which Selected Firm must create, obtain, transmit, use, maintain, process, or dispose of University Data.

b. If Selected Firm must under the Underlying Agreement create, access, obtain, transmit, use, maintain, process, or dispose of Protected University Data or financial or business data which has been identified to Selected Firm as having the potential to affect the accuracy of the University’s financial statements, Selected Firm will at its expense conduct or have conducted, at least annually, a:

1. security audit by a third party with audit scope and objectives deemed sufficient by the University, which attests Selected Firm’s security policies, procedures, and controls;

2. vulnerability scan by a third party of Selected Firm’s electronic systems and facilities that are used in any way to deliver electronic services under this Addendum; and

3. formal penetration test by a third party of Selected Firm’s electronic systems and facilities that are used in any way to deliver electronic services under this Addendum.

c. Additionally, Selected Firm will provide the University upon request the results of the above audits, scans and tests, and will promptly modify its security measures as needed based on those results in order to meet its obligations under this Addendum. The University may require, at University expense, Selected Firm to perform additional audits and tests, the results of which will be provided promptly to the University.

10. Compliance

a. Selected Firm will comply with all applicable laws and industry standards in performing Goods/Services under the Underlying Agreement. Any Selected Firm personnel visiting the University’s facilities will comply with all applicable University policies regarding access to, use of, and conduct within such facilities. The University will provide copies of such policies to Selected Firm upon request.

b. Selected Firm warrants that the service it will provide to the University is fully compliant with all state and federal laws, regulations, industry codes, and guidance that may be applicable to the service, which may include:

1. any applicable national, federal, state or local law, rule, directive or regulation relating to the privacy of personal information, including, without limitation, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g, and its implementing regulations (“FERPA), the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Privacy and Security Rules issued thereunder, the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), the Financial Modernization Act of 1999 (“Gramm-Leach- Bliley Act”), the Fair Credit Reporting Act as amended by the Fair and Accurate Credit Transactions Act, the Americans with Disabilities Act, and the Virginia Consumer Data Protection Act;

2. any privacy policy or practice applicable to any personal information that Customer or any User accesses, uses, collects, or maintains hereunder, including, without limitation any practice required in connection with the processing of credit card data, including the Payment Card Industry Data Security Standards (PCI-DSS); and

3. Federal Export Administration Regulations, Federal Acquisitions Regulations, Defense Federal Acquisitions Regulations and Department of Education guidance.

c. If the Payment Card Industry Data Security Standard (PCI-DSS) is applicable to Selected Firm service provided to the University, Selected Firm agrees to:

1. Store, transmit, and process University Data in scope of the PCI DSS in compliance with the PCI DSS; and

2. Attest that any third-party providing Goods/Services in scope of PCI DSS under the Underlying Agreement will store, transmit, and process University Data in scope of the PCI DSS in compliance with the PCI DSS; and

3. Provide either proof of PCI DSS compliance or a certification (from a recognized third-party security auditing Firm), within 10 business days of the request, verifying Selected Firm and any third party who stores, transmits, or processes University data in scope of PCI DSS as part of the Goods/Services provided under the Underlying Agreement maintains ongoing compliance under PCI DSS as it changes over time; and

4. Store, transmit, and process any University Data in scope of the PCI DSS in a manner that does not bring the University’s network into PCI DSS scope; and

5. Attest that any third-party providing Goods/Services in scope of PCI DSS under the Underlying Agreement will store, transmit, and process University Data in scope of the PCI DSS in a manner that does not bring the University’s network into PCI DSS scope.

11. Survival Selected Firm’s obligations under Section 8 shall survive termination of this Addendum until all University Data has been returned or Securely Destroyed.

IN WITNESS WHEREOF, each of the undersigned has caused this Addendum to be duly executed in its name and on its behalf effective as of the Effective Date stated above herein.

FOR THE RECTOR AND VISITORS OF

THE UNIVERSITY OF VIRGINIA

(“UVA” OR “UNIVERSITY”)

Signature:

Name:

Title:

Date:

Tracking #: UVA-AGR-____

FOR ________________________________

(“SELECTED FIRM”)

Signature:

Name:

Title:

Date: