Laserfiche WebLink
<br />CalOptima Health PHA MOU Page 9 of 18 <br />4. Firewall protection. <br />5. Use of encryption methods of electronic data while in transit from the Parties ’ <br />networks to external ne tworks, when applicable. <br />6. Measures to securely store all data, including, but not be limited to, encryption <br />at rest and multiple levels of authentication and measures , to ensure data shall <br />not be altered or corrupted by third parties. The Parties further re present and <br />warrant that they have implemented and will maintain during the term of this <br />MOU administrative, technical, and physical safeguards and controls consistent <br />with state and federal security requirements. <br />B. At termination of this MOU and the records retention period required herein , <br />whichever is later, if feasible, the Parties shall return or destroy all information <br />received from the other Parties. If such return or destruction is not feasible, the <br />Parties shall extend the protections of this MOU to the information and limit further <br />uses and disclosures to those purposes that make the return or destruction of the <br />information infeasible. <br />XIV. SECURITY BREACH NOTIFICATION <br />A. All Parties shall have policies and procedures in place for the effective management <br />of Security Breaches, as defined below. In the event of any actual, attempted, <br />suspected, threatened, or reasonably foreseeable circumstance C alOptima or a PHA <br />experiences or learns of that either compromises or could reasonably be expected <br />to comprise CalOptima or PHA data through unauthorized use, disclosure, or <br />acquisition of CalOptima or PHA data (“Security Breach ”), the Party that has <br />identified the potential Security Breach shall notify the other Party of its discovery <br />within twenty four (24) hours. After such notification, the Party that has identified <br />the potential Security Breach of the other Parties’ data shall, at its own expense, <br />promptly: <br />1. Investigate to determine the nature and extent of the Security Breach ; <br />2. Contain the incident by taking necessary action, including, but not limited to, <br />attempting to recover records, revoking access, and/or correcting weaknesses <br />in security; and <br />3. Report to the other Party the nature of the Security Breach, the data used or <br />disclosed, the person who made the unauthorized use or received the <br />unauthorized disclosure, what has been done or will be done to mitigate any <br />harmful effect of the unauthorized use or disclosure, and the corrective action <br />that has been taken or will be taken to prevent future similar unauthorized use <br />or disclosure. <br />B. The Party, whose data has been breached in violation of applicable law , at its sole <br />discretion and on a case-by -case basis, will determine what actions are necessary <br />in response to the breach and who will perform these actions. Actions may include <br />EXHIBIT 1