Orange County NC Website
Browse       Search
g. Notify Participant as soon as practical after first becoming aware of a Data Breach affecting Data <br /> provided by Participant. For disclosures of social security numbers or confirmed breaches of <br /> Participant data,this notice will occur promptly after reporting the Data Breach to the State unless <br /> the State or an investigatory agency requests notification be delayed so as not to hinder any law <br /> enforcement activities or investigations. The notification will include,to the extent available: <br /> i. A brief description of what happened, including the date of the Data Breach and the date <br /> of discovery of the Data Breach; <br /> ii. The identification of each Individual whose Data has been,or is reasonably believed to have <br /> been,accessed,acquired,used,or Disclosed; <br /> iii. A description of the roles of the people involved in the Data Breach (e.g., employees, <br /> Authorized Users,service providers,unauthorized persons,etc.); <br /> iv. A description of the types of Data involved in the Data Breach (whether full name,Social <br /> Security number,date of birth, home address,account number,diagnosis,disability code, <br /> or other types of identifiable information); <br /> v. The number of Individuals or records impacted estimated to be impacted by the Data <br /> Breach; <br /> vi. A description of actions takers to investigate the Data Breach, to mitigate harm to <br /> Individuals,and to protect against any further Data Breaches; <br /> vii. The current status of the Data Breach(under investigation or resolved); <br /> viii, Contact procedures for Individuals to ask questions or learn additional information,which <br /> shall include a toll-free telephone number,an e-mail address,Web site,or postal address; <br /> and <br /> ix. Corrective actions taken and planned to prevent a similar Data Breach. <br /> h. Ensure that any subcontractors,agents,or other third parties used by N3CN execute all necessary <br /> documents binding those subcontractors,agents,or other third parties to protect the privacy and <br /> security of the Data Platform and the Data consistent with the obligations of this Agreement and <br /> all Applicable Law. <br /> 11. Obligations Based on Category of Participant. This Agreement must include the applicable exhibit(s), <br /> as listed below and incorporated herein by reference, to describe additional obligations specific to <br /> Participant's type of entity, If Participant is a type that does not have additional obligations based on <br /> its type,Participant will not have an attached exhibit. If Participant may perform obligations as more <br /> than one type of entity,more than one exhibit will be attached,and all those obligations will apply to <br /> Participant. <br /> a. Division of State owned Hospitals and Facilities. Additional DSDHF obligations will be those <br /> described in Exhibit:DSQHF. <br /> b. County or other Government Agency. Additional County obligations will be those described in <br /> Exhibit:Governmental Entity. <br /> c. Subcontractor. Additional Subcontractor obligations will be those described in Exhibit: <br /> Subcontractor. <br /> Page 10 of 21 <br />