2017-427-E DSS - Durham Technical Community College for employment services

Browse Search

DocuSign Envelope ID:46BCB3EE-5A8D-41 CE-B703-D32F5BCA1053 NC-DSS Contract- Subcontract Addendum 1.0 Due to the sensitivity of the data exchanged between invested parties,the following Data Privacy and Security Language will serve as an addendum to the Contract between [Name of Contractor] and its subcontractors for the 2017-2018 federal fiscal year. DATA PRIVACY AND SECURITY The Contractor certifies that it shall adopt and apply data security standards and procedures that comply with all applicable federal,,state, and local laws, regulations, and rules. Such standards and procedures include, but are not Iimited to access to systems and data; transmission and storage of data; access to, disclosure, sharing and confidentiality of client records; use, retention and disposal of data; and reporting of security incidents and breaches. The Contractor agrees to maintain compliance with the following: NC DHHS Privacy Manual and Security Manual,both located online at https://www2.ncdhhs.gov/info/olm/manuals/dhs/pol-80/rnan/ NC Statewide Information Security Manual, located online at https://it.nc.gov/doclunent/statewide-information-security-manua l CONFIDENDIALITY Any information, data, instruments, documents, studies or reports given to or prepared or assembled by the Contractor under this agreement shall be kept as confidential and not divulged or made available to any individual or organization without the prior written approval of the division. The contractor acknowledges that in receiving, storing, processing or otherwise dealing with any confidential information it will safeguard and not further disclose the information except as otherwise provided in this contract. The Contactor shall report a suspected or confirmed security breach to the state Division of Social Services, or local Department of Social Services/Human Services Contract Administrator, as appropriate to this contract,within twenty-four(24)hours after the breach is first discovered,provided that the Contractor shall report a breach involving Social Security Administration data or Internal Revenue Service data within one(1)hour after the breach is first discovered. If any applicable federal, state,or local law, regulation, or rule requires the Contractor to give written notice of a security breach to affected persons,the Contractor shall bear the cost of the notice. During the performance of this contract,the contractor agrees to notify the Contract Administrator of any contact by the federal Office for Civil Rights (OCR) received by the contractor. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) The Contractor agrees that, if the Division determines that some or all of the activities within the scope of this contract are subject to the Health Insurance Portability and Accountability Act of 1996, P.L. 104-91, as amended("HIPAA"), or its implementing regulations, it will comply with the HIPAA requirements and will execute such agreements and practices as the Division may require to ensure compliance. Continuous Monitoring For contracts involving procurement of cloud-hosted solutions or off-site hosting services, Contractor will maintain compliance with the State CISO's mandate for a Continuous Monitoring Process. Contractor must work with the Division to implement a risk management program that continuously monitors risk through assessments, risk analysis and data inventory. The requirements are based on NIST 800-37,