Orange County NC Website
Browse       Search
vi. A description of actions taken to investigate the Data Breach, to mitigate harm to <br /> Individuals,and to protect against any further Data Breaches; <br /> vii. The current status of the Data Breach (under investigation or resolved); <br /> viii. Contact procedures for Individuals to ask questions or learn additional information,which <br /> shall include a toll-free telephone number,an e-mail address,Web site,or postal address; <br /> and <br /> ix. Corrective actions taken and planned to prevent a similar Data Breach. <br /> n. Ensure that any subcontractors, agents, or other third parties used by Participant or by any <br /> Authorized User execute all necessary documents binding those subcontractors,agents,or other <br /> third parties to protect the privacy and security of the Data Platform and the Data consistent with <br /> the obligations of this Agreement and all Applicable Law. <br /> 10. N3CN Data Obligations. N3CN agrees to: <br /> a. Follow all Applicable Law. <br /> b. Ensure N3CN's workforce members, including any contractors,access and use the Data Platform <br /> and access, use, store, maintain, and transfer Participant Data only for Permitted Purposes and <br /> consistent with all Applicable Law. <br /> c. Monitor all access and use of the Data Platform and all access, use, storage, maintenance, and <br /> transfer of the Data occurring at a location owned, leased, or controlled by N3CN, or occurring <br /> through equipment under the ownership or control of N3CN,to ensure all access and use is only <br /> for Permitted Purposes and consistent with all Applicable Law. <br /> d. Implement and maintain reasonable administrative,technical,and physical safeguards to protect <br /> the confidentiality, integrity,and availability of the Data Platform and the Data. <br /> L Administrative safeguards must include written policies and procedures for managing access, <br /> use, storage, maintenance, transfer, and disclosure of Data and access and use of the Data <br /> Platform and must include sanctions for any violations of those policies and procedures. <br /> ii. Technical safeguards must include appropriate security lockouts,password management, data <br /> encryption, and related mechanisms to ensure the privacy and security of the Data Platform <br /> and the Data. <br /> iii. Physical safeguards must include restricted access to places where the Data Platform and the <br /> Data may be accessed,used,or disclosed. <br /> e. Ensure N3CN workforce members have appropriate role-based access to the Data Platform and <br /> the Data that complies with the Minimum Necessary Standard under HIPAA. <br /> f. Implement and maintain written policies and procedures that address: (1) proper access to and <br /> use of the Data Platform and the Data;(2)audit controls and periodic reviews to ensure access to <br /> and use of the Data Platform and the Data is for Permitted Purposes only; (3) notification to <br /> Participant of any changes in the Data Platform,the Data, or the policies and processes through <br /> which they are accessed or used; (4) notification to Participant of any unauthorized access to or <br /> use of Participant Data by N3CN's Authorized Users of which N3CN becomes aware(unless N3CN <br /> is required not to make such notification as part on an ongoing criminal investigation);and (5) <br /> protection against malware and other mechanisms, both tangible and intangible, designed to <br /> disrupt,destroy,damage,or delay the operation of the Data Platform or the Data. <br /> Page 9 of 21 <br />