Agenda Packet_2025-07-15 - Laserfiche WebLink

Home Browse Search

Docusign Envelope IM; 72A91B36-BEA1-46FE-ACDD-146571BB7804 EXHIBIT 2 that includes verification of delivery and receipt, unless the Contractor obtains prior written permission from HHS to use another method. 11. NOTIFICATION AND INVESTIGATION OF BREACHES AND SECURITY INCIDENTS During the term of this Agreement, the County agrees to implement reasonable systems for the discovery and prompt reporting of any Breach or Security Incident, and to take the following steps: a. Initial Notice to HHS: i. The Contractor will provide initial notice to the County. The Contractor agrees to perform the following incident reporting to County. ii. Immediately upon discovery of a suspected security incident that involves data provided to Contractor by County, the Contractor will notify the County by email or telephone. iii. Within one working day of discovery, the Contractor will notify the County by email or telephone of unsecured PII, if that PII was, or is, reasonably believed to have been accessed or acquired by an unauthorized person, any suspected security incident, intrusion, or unauthorized access, use, or disclosure of Pll in violation of this Agreement, or potential loss of confidential data affecting this Agreement. Notice shall be made by contacting the County as provided in this agreement, including all information known at the time. iv. A breach shall be treated as discovered by the Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach), who is an employee, officer or other agent of the Contractor. V. Upon discovery of a breach, security incident, intrusion, or unauthorized access, use, or disclosure of PII, the Contractor shall take: A. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment; and B. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations. b. Investigation and Investigative Report. The Contractor shall immediately investigate breaches and security incidents involving PII. The Contractor will cooperate with the County during this investigation. Within seventy-two (72) hours of discovery, the Contractor shall provide new or updated information if available to County. The updated report shall include any other applicable information related to the breach or security 11 City Council 7 — 127 7/15/2025