Laserfiche WebLink
Mental Health, the California Office of Community Colleges and the Department of Alcohol and <br />Drug Programs. <br />The Pass-through Entity and Subrecipient agree that: <br />a. Each party shall keep all Information that is exchanged between them in the strictest <br />confidence and make such information available to their own employees only on a <br />"need -to -know" basis. <br />b. Each party shall provide security sufficient to ensure protection of confidential <br />information from improper use and disclosures, including sufficient administrative, <br />physical, and technical safeguards to protect this information from reasonable <br />unanticipated threats to the security or confidentiality of the information. <br />c. The Subrecipient agrees that information obtained under this subgrant agreement will <br />not be reproduced, published, sold or released in original or in any other form for <br />any purpose other than those specifically Identified in this agreement. <br />1. Aggregate Summaries: All reports and/or publications developed by the <br />Subrecipient based on data obtained under this agreement shall contain <br />confidential data in aggregated or statistical summary form only. "Aggregated" <br />refers to a data output that does not allow identification of an individual or <br />employer unit. <br />2. Publication: Prior to publication, Subrecipient shall carefully analyze <br />aggregated data outputs to ensure the identity of individuals and/or employer <br />units cannot be inferred pursuant to California Unemployment Insurance Code <br />Section 1094(c). Personal identifiers must be removed. Geographic identifiers <br />should be specified only In large areas and as needed, and variables should be <br />recorded In order to protect confidentiality. <br />3. Minimum Data Cell Size: The minimum data cell size or derivation thereof shall <br />be three participants for any data table released to outside parties or to the <br />public. <br />d. Each party agrees that no disaggregate data, identifying individuals or employers, <br />shall be released to outside parties or the public. <br />e. The Subrecipient shall notify Pass-through Entity's Information Security Office of <br />any actual or attempted information security incidents, within 24 hours of initial <br />detection, by telephone at (916) 654-6231. Information security incidents include, <br />but are not limited to, any event (intentional or unintentional), that causes the <br />loss, damage, or destruction, or unauthorized access, use, modification, or <br />disclosure of information assets. <br />The Subrecipient shall cooperate with the Pass-through Entity in any investigation of <br />security incidents. The system or device affected by an information security incident and <br />containing confidential data obtained in the administration of this program shall be <br />immediately removed from operation upon confidential data exposure or a known security <br />breach. It shall remain removed from operation until correction and mitigation measures are <br />applied. If the Subrecipient learns of a breach in the security of the system which contains <br />confidential data obtained under this Subgrant, then the Subrecipient must provide <br />notification to individuals pursuant to California Civil Code Section 1798.82. <br />f. The Subrecipient shall provide for the management and control of physical access to <br />information assets (including personal computer systems, computer terminals, mobile <br />computing devices, and various electronic storage media) used in performance of this <br />Subgrant. This shall include, but is not limited to, security measures to physically <br />protect data, systems, and workstations from unauthorized access and malicious <br />activity; the prevention, detection, and suppression of fires; and the prevention, <br />detection, and minimization of water damage. <br />g. At no time will confidential data obtained pursuant to this agreement be placed on a <br />mobile computing device, or on any form of removable electronic storage media of any <br />kind unless the data are fully encrypted. <br />h. Each party shall provide its employees with access to confidential information with <br />written instructions fully disclosing and explaining the penalties for unauthorized <br />use or disclosure of confidential information found in Section 1798.55 of the <br />California Civil Code, Section 502 of the California Penal Code, Section 2111 of the <br />Page 14 of 16 <br />