Common use of Commonwealth Security Information Clause in Contracts

Commonwealth Security Information. If the Transportation Provider obtains access to any Commonwealth Security Information in connection the Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards to maintain the confidentiality, security, integrity, and availability of such information. Notwithstanding any other provision in in these Transportation Provider Performance Standards, the Transportation Provider shall report any non-permitted use or disclosure of Commonwealth Security Information to EOHHS within twenty- four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Party Agreement). The Transportation Provider shall immediately take all reasonable actions to retrieve such information if disclosed to any non-permitted person or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as EOHHS may reasonably require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.

Commonwealth Security Information. If the Transportation Provider obtains access to any Commonwealth Security Information in connection the Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions instructions, unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these Transportation Provider Performance Standards, the Transportation Provider shall report any non-non- permitted use or disclosure of Commonwealth Security Information to EOHHS within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Party Agreement). The Transportation Provider shall immediately take all reasonable actions to retrieve such information if disclosed to any non-permitted person or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as EOHHS may reasonably require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.

Commonwealth Security Information. If the Transportation Provider obtains access to any Commonwealth Security Information in connection the Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions instructions, unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these Transportation Provider Performance Standards, the Transportation Provider shall report any non-permitted use or disclosure of Commonwealth Security Information to EOHHS within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Party Agreement). The Transportation Provider shall immediately take all reasonable actions to retrieve such information if disclosed to any non-permitted person or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as EOHHS may reasonably require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.

Commonwealth Security Information. If through the Transportation Provider Subcontract, the Transportation Provider obtains access to any Commonwealth Security Information Information, Transportation Provider is prohibited from making any disclosures of or about such information, unless in connection accord with EOHHS’s or Broker’s express written instructions. If the Transportation Provider is granted access to such information in order to perform its obligations under its Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as staff or agents necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards this Section VIII, as applicable, to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these the Transportation Provider Performance StandardsSubcontract, the Transportation Provider shall report any non-permitted use or disclosure of Commonwealth Security Information such information to EOHHS the Broker within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Party Agreement)discovery. The Transportation Provider shall immediately take all reasonable and legal actions to retrieve such information if disclosed to any non-permitted person individual or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as the Broker or EOHHS may reasonably shall require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract such Subcontract, unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.accord with Section

Commonwealth Security Information. If the Transportation Provider obtains access to any Commonwealth Security Information in connection the Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions instructions, unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these Transportation Provider Performance Standards, the Transportation Provider shall report any non-permitted use or disclosure of Commonwealth Security Information to EOHHS within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Third Party Agreement). The Transportation Provider shall immediately take all reasonable actions to retrieve such information if disclosed to any non-permitted person or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as EOHHS may reasonably require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.

Commonwealth Security Information. If the Transportation Provider obtains access to any Commonwealth Security Information in connection the Transportation Provider SubcontractInformation, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce Workforce members as necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s ’ express written instructions instructions, unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standardsthe Contract (including this Appendix). While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards the Contract (including this Appendix) to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these Transportation Provider Performance Standardsthe Contract (including this Appendix), the Transportation Provider shall report any non-permitted use or disclosure of Commonwealth Security Information to EOHHS within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Party Agreement)disclosure. The Transportation Provider shall immediately take all reasonable actions to retrieve such information if disclosed to any non-permitted person or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as EOHHS may reasonably require. Notwithstanding any other provision in the Transportation Provider Subcontract Contract (including in this Appendix) regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract Contract unless such information is expressly identified in any retention permission granted in accord. accord with Section 2.4 of Appendix A. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract Contract and shall apply for as long as the Transportation Provider retains the information. Obligations upon a Non-Permitted Use or Disclosure of PI or other Event Mitigation and Other Activities. Immediately upon becoming aware of an Event, the Provider shall take all reasonable and appropriate action necessary to: a) retrieve, to the extent practicable, any PI involved in the Event; b) mitigate, to the extent practicable, any harmful effect of the Event known to the Provider; and c) take such other action(s) as may be required in connection with the Event to comply with any Applicable Law. Upon request, the Provider shall take such further actions as EOHHS, may reasonably request to, or shall take such additional action to assist EOHHS further mitigate, to the extent practicable, any harmful effect of the Event. Any actions to mitigate harmful effects of such Event undertaken by the Provider on its own initiative or pursuant to EOHHS’ request shall not relieve the Provider of its obligations to report such Event or otherwise comply with this Section 2.5 of Appendix A or any other applicable provisions of the Contract or this Appendix.

Commonwealth Security Information. If the Transportation Provider obtains access to any Commonwealth Security Information in connection the Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions instructions, unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these Transportation Provider Performance Standards, the Transportation Provider shall report any non-non- permitted use or disclosure of Commonwealth Security Information to EOHHS within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Third Party Agreement). The Transportation Provider shall immediately take all reasonable actions to retrieve such information if disclosed to any non-permitted person or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as EOHHS may reasonably require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.

Commonwealth Security Information. If through the Transportation Provider Subcontract, the Transportation Provider obtains access to any Commonwealth Security Information Information, Transportation Provider is prohibited from making any disclosures of or about such information, unless in connection accord with EOHHS’s or Broker’s express written instructions. If the Transportation Provider is granted access to such information in order to perform its obligations under its Transportation Provider Subcontract, the Transportation Provider may only use such information for the purposes for which it obtained access. In using the information for such permitted purposes, the Transportation Provider shall limit access to the information only to its employees and other workforce members as staff or agents necessary to perform the permitted purposes. The Transportation Provider shall not release or disclose such information except in accord with EOHHS’s express written instructions unless such disclosure is Required by Law and then only in accordance with these Transportation Provider Performance Standards. While in possession of such information, the Transportation Provider shall apply all applicable privacy and security requirements set forth in these Transportation Provider Performance Standards this Section VIII, as applicable, to maintain the confidentiality, security, integrity, integrity and availability of such information. Notwithstanding any other provision in in these the Transportation Provider Performance StandardsSubcontract, the Transportation Provider shall report any non-permitted use or disclosure of Commonwealth Security Information such information to EOHHS the Broker within twenty- twenty-four (24) hours following the date upon which the Transportation Provider becomes aware of the use or disclosure (or such earlier time as may be required under a Third-Party Agreement)discovery. The Transportation Provider shall immediately take all reasonable and legal actions to retrieve such information if disclosed to any non-permitted person individual or entity; shall include a summary of such retrieval actions in its required report of the non-permitted disclosure; and shall take such further retrieval action as the Broker or EOHHS may reasonably shall require. Notwithstanding any other provision in the Transportation Provider Subcontract regarding termination, the Transportation Provider may not retain any Commonwealth Security Information upon termination of the Transportation Provider Subcontract such Subcontract, unless such information is expressly identified in any retention permission granted in accord. If retention is expressly permitted, all data protections stated herein survive termination of the Transportation Provider Subcontract and shall apply for as long as the Transportation Provider retains the information.accord with Section VIII.F. (