Common use of Personally Identifiable Information Clause in Contracts

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-four

Personally Identifiable Information. While performing its obligations under this Contract, Contractor Procuring Party may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx- Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor Procuring Party agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor Procuring Party shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor Procuring Party and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor Procuring Party shall immediately notify State: (1) of any disclosure or use of any PII by Contractor Procuring Party or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor Procuring Party or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor Procuring Party or its employees, agents and representatives. The State reserves the right to review ContractorProcuring Party's policies and procedures used to maintain the security and confidentiality of PII and Contractor Procuring Party shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor Procuring Party is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor Procuring Party shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor Procuring Party shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor Procuring Party (“Unauthorized Disclosure”) that come to the ContractorProcuring Party’s attention. Any such report shall be made by the Contractor Procuring Party within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Procuring Party. Procuring Party shall take all necessary measures to halt any further Unauthorized Disclosures. The Procuring Party, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Procuring Party shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“"PII”"). For the purposes of this Contract, “"PII” " includes “"Nonpublic Personal Information” " as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“"GLBA”") and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“"Privacy Laws”"). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s 's direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“"Unauthorized Disclosure”") that come to the Contractor’s 's attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not knowingly do or omit to do anything which would cause the State to be in breach of any Privacy LawsLaws applicable to Contractor’s products, services, or Software as a Service Cloud hosting offerings. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security designed to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) State of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) . Contractor shall notify State of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The As part of the audit referenced in section 45, the State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The foregoing obligation to return or destroy shall not apply to PII included as part of Administrative Data, Payment Data, Support Data and Telemetry Data. For as long as Contractor retains such data, Contractor shall exercise at least the same degree of care as it uses with its own data of similar nature, but in no event less than reasonable care, and shall deploy appropriate security measures designed to protect such data against unauthorized access, use, or disclosure. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made to: xxxxx.xxxxxxxx@xx.xxx by the Contractor within twentyforty-foureight (48) hours after the Unauthorized Disclosure has been confirmed by the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. To the extent the Contractor is at fault, the Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure for up to one (1) year (or more if required by applicable Privacy Laws). To the extent the Contractor is at fault, the Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. The obligations set forth in this Section shall survive the termination of this Contract. ATTACHMENT B ATTESTATION RE PERSONNEL USED IN PARTICIPATING ADDENDUM PERFORMANCE SUBJECT CONTRACT NUMBER: Participating Addendum Number: CONTRACTOR LEGAL ENTITY NAME: Cisco Systems, Inc. EDISON VENDOR IDENTIFICATION NUMBER: The Contractor, identified above, does hereby attest, certify, warrant, and assure that the Contractor shall not knowingly utilize the services of an illegal immigrant in the performance of this Participating Addendum and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant in the performance of this Participating Addendum.

Personally Identifiable Information. While performing its obligations under this ContractAgreement, Contractor either party may have access to Personally Identifiable Information held by the State other party (“"PII”"). For the purposes of this ContractAgreement, “"PII” " includes “"Nonpublic Personal Information” " as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“"GLBA”") and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“"Privacy Laws”"). Contractor agrees it The parties agree they shall not do or omit to do anything which would cause the State other to be in breach of any Privacy Laws. Contractor Each party shall, and shall cause its employees, agents and representatives to: (i) keep PII Pll confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII Pll was disclosed to Contractor it and in accordance with this ContractAgreement, GLBA and Privacy Laws; and (ii) implement and maintain appropriate appropria te technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PIIPll; (B) protect against any threats or hazards to the security or integrity of PIIPll; and (C) prevent unauthorized access to or use of PIIPll. Contractor Each party shall immediately notify Statethe other: (1) of any disclosure or use of any PII by Contractor it or any of its employees, agents and representatives in breach of this ContractAgreement; and (2) of any disclosure of any PII Pll to Contractor a party or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor it or its employees, agents and representatives. The State Each party reserves the right to review Contractor's the other’s policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State other party to enable the State it to verify or ensure and/or procure that Contractor it is in full compliance with its obligations under this Contract Agreement in relation to PIIPll. Upon termination or expiration of the Contract Agreement or at the State’s direction of one party at any time in its sole discretion, whichever is earlier, Contractor the other party shall immediately return to the State any and all PII which it has received under this Contract Agreement and shall destroy all records of such PII. The Contractor Each party shall report to the State other any instances of unauthorized access to or potential potentia l disclosure of PII Pll in the its custody or control of Contractor (“"Unauthorized Disclosure”") that come to the Contractor’s its attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the reporting party’s attention. Each party shall take all necessary measures to halt any further Unauthorized Disclosures. Each party, at the sole discretion of the other, shall provide no cost credit monitoring services for individua ls whose Pll was affected by the Unauthorized Disclosure. Each party shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individua l letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available under this Agreement or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-four

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State with respect to this Contract, or an Authorized Entity with respect to a PA, (“PII”). For the purposes of this Contract or any PA under this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State or an Authorized Entity to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify StateState or an Authorized Entity: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State or an Authorized Entity reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State or an Authorized Entity to enable the State or an Authorized Entity to verify or ensure and/or procure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s or an Authorized Entity’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State or an Authorized Entity any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State or an Authorized Entity any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State or an Authorized Entity, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract an Authorized Entity with respect to a PA or as otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourtwenty- four (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. The obligations set forth in this Section shall survive the termination of this Contract. IN WITNESS WHEREOF, CONTRACTOR LEGAL ENTITY NAME: CONTRACTOR SIGNATURE DATE PRINTED NAME AND TITLE OF CONTRACTOR SIGNATORY (above) TENNESSEE DEPARTMENT OF INTELLECTUAL AND DEVELOPMENTAL DISABILITIES: COMMISSIONER, XXXX XXXXXX DATE ATTACHMENT A ATTESTATION RE PERSONNEL USED IN CONTRACT PERFORMANCE SUBJECT CONTRACT NUMBER: CONTRACTOR LEGAL ENTITY NAME: EDISON VENDOR IDENTIFICATION NUMBER: The Contractor, identified above, does hereby attest, certify, warrant, and assure that the Contractor shall not knowingly utilize the services of an illegal immigrant in the performance of this Contract and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant in the performance of this Contract.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor Procuring Party may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx- Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor Procuring Party agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor Procuring Party shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor Procuring Party and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor Procuring Party shall immediately notify State: (1) of any disclosure or use of any PII by Contractor Procuring Party or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor Procuring Party or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor Procuring Party or its employees, agents and representatives. The State reserves the right to review ContractorProcuring Party's policies and procedures used to maintain the security and confidentiality of PII and Contractor Procuring Party shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor Procuring Party is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor Procuring Party shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor Procuring Party shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor Procuring Party (“Unauthorized Disclosure”) that come to the ContractorProcuring Party’s attention. Any such report shall be made by the Contractor Procuring Party within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Procuring Party. Procuring Party shall take all necessary measures to halt any further Unauthorized Disclosures. The Procuring Party, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Procuring Party shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. IN WITNESS WHEREOF, PUBLIC CONSULTING GROUP LLC.: June 30, 2021 PROCURING PARTY SIGNATURE DATE Xxxxxx Xxxxxx, Manager PRINTED NAME AND TITLE OF PROCURING PARTY SIGNATORY (above) DEPARTMENT OF FINANCE AND ADMINISTRATION DIVISION OF HEALTH CARE FINANCE AND ADMINISTRATION: Xxxxx Xxxx Digitally signed by Xxxxx Xxxx Date: 2021.06.30 13:40:36 -05'00' XXXXX XXXX, COMMISSIONER DATE ATTACHMENT A State of Tennessee Department of Finance and Administration Division of TennCare Trading Partner Agreement THIS TRADING PARTNER AGREEMENT ("Agreement") is between The State of Tennessee, Department of Finance and Administration, Division of TennCare ("TennCare" or "the State"), 310 Great Circle Road, Nashville, TN 37243, and Public Consulting Group LLC ("Trading Partner") located at 000 Xxxxx Xxxxxx, Xxxxx 0000, Xxxxxxxxx, Xxxxxxxxx 00000 , including all office locations and other business locations at which Trading Partner data may be used or maintained. Trading Partners may be referred to herein individually as "Party" or collectively as "Parties."

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. The obligations set forth in this Section shall survive the termination of this Contract. IN WITNESS WHEREOF, CONTRACTOR LEGAL ENTITY NAME: CONTRACTOR SIGNATURE DATE PRINTED NAME AND TITLE OF CONTRACTOR SIGNATORY (above) TENNESSEE HIGHER EDUCATION COMMISSION: DR. XXXXX HOUSE, EXECUTIVE DIRECTOR DATE ATTACHMENT A ATTESTATION RE PERSONNEL USED IN CONTRACT PERFORMANCE If the attestation applies to more than one contract, modify this row accordingly. SUBJECT CONTRACT NUMBER: CONTRACTOR LEGAL ENTITY NAME: EDISON VENDOR IDENTIFICATION NUMBER: If the attestation applies to more than one contract, modify the following paragraph accordingly. The Contractor, identified above, does hereby attest, certify, warrant, and assure that the Contractor shall not knowingly utilize the services of an illegal immigrant in the performance of this Contract and shall not knowingly utilize the services of any subcontractor who will utilize the services of an illegal immigrant in the performance of this Contract.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourand

Personally Identifiable Information. While performing its obligations under this Contract, Contractor Procuring Party may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-- Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and supp other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor Procuring Party agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor Procuring Party shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor Procuring Party and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor Procuring Party shall immediately notify State: (1) of any disclosure or use of any PII by Contractor Procuring Party or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor Procuring Party or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor Procuring Party or its employees, agents and representatives. The State reserves the right to review ContractorProcuring Party's policies and procedures used to maintain the security and confidentiality of PII and Contractor Procuring Party shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor Procuring Party is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor Procuring Party shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor Procuring Party shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Procuring Party Procuring Party Any such report shall be made by the Contractor Procuring Party within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Procuring Party. Procuring Party shall take all necessary measures to halt any further Unauthorized Disclosures. The Procuring Party, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Procuring Party shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII PI only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourand

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx--Xxxxx- Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PIIPII except that the Contractor may retain an electronic copy in accordance with its records retention policy. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. The obligations set forth in this Section shall survive the termination of this Contract.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourfour (24) Hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twentyforty-foureight (48) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twentyforty-foureight (48) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. The obligations set forth in this Section shall survive the termination of this Contract.

Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Xxxxx-Xxxxx-Xxxxxx Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure and/or procure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII. The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-fourfour (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.