HomeMy WebLinkAboutAgreements/Contracts - Renew (003)GRANT COUNTY
COMMISSIONERS AGENDA MEETING REQUEST FORM
(Must be submitted to the Clerk of the Board by 12:00pm on Thursday)
REQUESTING DEPARTMENT: Renew
REQUEST SUBMITTED BY: Linze Greenwalt
CONTACT PERSON ATTENDING ROUNDTABLE: Dell Anderson
CONFIDENTIAL INFORMATION: ❑YES *NO
DATE: 10. 15.26
PHONE: x5470
fifiarm"Imak"'AW-4r
®Agreement / Contract
❑AP vouchers
DAppointment / Reappointment
DARPA Related
C:1 Bids / RFPs / Quotes Award
❑ Bid Opening Scheduled
❑ Boards / Committees
❑ Budget
❑ Computer Related
❑ County Code
❑ Emergency Purchase
❑ Employee Rel.
❑ Facilities Related
❑ Financial
❑ Funds
❑ Hearing
❑ Invoices / Purchase Orders
❑ Grants — Fed/State/County
❑ Leases
❑ MOA / MOU
❑Minutes
❑Ordinances
El Out of State Travel
❑Petty Cash
❑ Policies
❑ Proclamations
❑ Request for Purchase
❑ Resolution
El Recommendation
El Professional Serv/Consultant
❑Support Letter
❑Surplus Req.
❑Tax Levies
❑Thank You's
❑Tax Title Property
❑WSLCB
M-1-
�
�1�r
Approve request for Dell Anderson to DocuSign Amendment 2 to Contract
No. K13553 between Washington State Department of Corrections and Grant
County dba Renew for DOSA Services. New terra is October 16, 2024
through October 16, 2027.
If necessary, was this document reviewed by accounting? ❑ YES ❑ NO 0 N/A
If necessary, was this document reviewed by legal? * YES ❑ NO ❑ N/A
DATE OF ACTION: ID 191V7-W
APPROVE: DENIED ABSTAIN
D1: it. 9,
D2:
D3:
DEFERRED OR CONTINUED TO:
WITHDRAWN:
4/23/24
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
K26-202
Washington State
Department of Corrections
Contract No. K13553
Amendment No. 2
T hliLg Ainnt einlcdlinrnentr is made between the Washington State Department of Corrections,
hereinafter referred to as "DOC" or "Department," and Grant County Renew, Grant Behavioral Health and
Wellness, hereinafter referred to as "Contractor," for the purpose of amending the above -referenced
Contract, heretofore entered into between Department and Contractor.
WHEREAS the purpose of this Amendment is to extend the contract term and add data sharing
terms and conditions.
NOW THEREFORE, in consideration of the terms and conditions contained herein, or attached
and incorporated and made a part hereof, Department and Contractor agree to the following:
1. Section I. CONTRACT TERM is hereby amended as follows:
Regardless of the date of execution, the initial term of this Contract, and subsequent extensions or
contractions thereto, shall commence and expire on the dates set forth below, unless earlier
terminated as provided herein.
Commencement Date
Expiration Date
Contract Term
October 16, 2024
October 15, 2025
First Extension
October 16, 2025
October 16, 2026
Second Extension
October 16, 2026
1 October 16, 2027
2. ATTACHMENT E, DATA SHARING TERMS AND CONDITIONS, is hereby attached and
incorporated into this contract.
Additions to this text are shown by underline and deletions by (( . ° )). All other terms and conditions
remain in full force and effect. The effective date of this Amendment is October 16, 2026.
THIS AMENDMENT, consisting of one (1) page and one (1) Attachment, is executed by the persons
signing below who warrant that they have the authority to execute this Amendment.
GRANT COUNTY RENEW, GRANT DEPARTMENT OF CORRECTIONS
BEHAVIORAL HEALTH AND WELLNESS
(Signature and Date)
PARC
(Printed Name)
(Signature and Date)
Daryl Huntsinger
(Printed Name)
Contracts Administrator
(Title) (Title)
Approved as to Form: This Amendment format was approved by the office of the Attorney General.
Approval on file.
Washington State K13553(2) Page 1 of 1
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
DATA SHARING TERMS AND CONDITIONS
1. DEFINITIONS
ATTACHMENT E
1.1. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a
network outside the control of the Contractor. Physical storage of data in the cloud typically
spans multiple servers and often multiple locations. Cloud storage can be divided between
consumer grade storage for personal files and enterprise grade for companies and governmental
entities. Examples of consumer grade storage would include iTunes, Google Drive, Dropbox,
Box.com, and other similar services/entities. Enterprise cloud vendors include Microsoft Azure,
Amazon Web Services, and Rackspace.
1.2. "DOC" and "Department" mean the Washington State Department of Corrections.
1.3. "DOC Data" means all data, information, records, and other materials provided to Recipient
under this Agreement.
1.4. "Encrypt" means to encode Confidential Information into a format that can only be read by those
possessing a "key"; a password, digital certificate, or other mechanism available only to
authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or
2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption
Standard (AES) must be used if available.
1.5. "FedRAMP" means the Federal Risk and Authorization Management Program (see
www.fedramp.gov), which is an assessment and authorization process that federal government
agencies have been directed to use to ensure security is in place when accessing Cloud computing
products and services.
1.6. "WaTech" means Washington Technology Solutions, formerly the Washington State Office of
the Chief Information Officer (OCIO).
1.7. "Recipient" means the entity that is identified in this Agreement and is a party to this Agreement
and which is receiving DOC Data, and includes the entity's owners, members, officers, directors,
partners, trustees, employees, and subcontractors and their owners, members, officers, directors,
partners, trustees, and employees.
2. PURPOSE
2.1. The purpose of this Data Sharing attachment is to set forth the terms and conditions under which
DOC will allow the restricted use of its confidential information to the Recipient, and under
which the Recipient may receive and use the confidential information. This Agreement ensures
that confidential information is provided, protected, and used only for purposes authorized by
this Agreement and in accordance with state and federal law.
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
2.2. Recipient has requested and intends to use DOC Data only for the following: to provide Drug
Offender Sentencing Alternative assessments ("DOSA Assessments").
3. DOC DATA
3.1. Data Classification. Washington State classifies data into the categories below based on the
sensitivity of the data pursuant to the security policy and standards promulgated by WaTech
SEC-08 Data Sharing Policy and SEC-08-01-S Data Classification Standard.
3.1.1. Category 1— Public Information
Public information is information that can be or currently is released to the public. It does
not need protection from unauthorized disclosure but does need integrity and availability
protection controls.
3.1.2. Category 2 — Sensitive Information
Sensitive information is not specifically protected from disclosure by law but is for official
use only. Sensitive information is generally not released to the public unless specifically
requested.
3.1.3. Category 3 — Confidential Information
Confidential information is information that is specifically protected from either release or
disclosure by law. This includes but is not limited to:
a. Personal Information as defined in RCW 42.56.590 and RCW 19.255.010;
b. Information about public employees as defined in RCW 42.56.250;
C. Lists of individuals for commercial purposes as defined in RCW
42.56.070(8);
d. Information about the infrastructure and security of computer and
telecommunications networks as defined in RCW 42.56.420.
3.1.4. Category 4 — Confidential Information Requiring Special Handling
Confidential information requiring special handling is information that is specifically
protected from disclosure by law and for which:
a. Especially strict handling requirements are dictated, such as by statutes,
regulations, agreements, or other external compliance mandates;
b. Serious consequences could arise from unauthorized disclosure, such as
threats to health and safety, or legal sanctions.
3.2 DOC Data
3.2.2. DOC Data will be on an individual -level and non -aggregated, with personal identifiers.
Washington State K13566(2) Page 3 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
3.2.3. Neither DOC nor the state of Washington guarantee or warrant the accuracy, timeliness,
or completeness of DOC Data provided under this Agreement.
3.2.4. DOC Data to be shared under this Agreement is set forth in Variable List, EXHIBIT E-3.
4. TRANSMISSION OF DOC DATA
4.1. DOC Data will be encrypted when shared electronically.
4.2. DOC Data will be sent on an as needed basis.
5. USE OF DOC DATA
5.1. Recipient shall access and use DOC Data and/or DOC IT Resources only for the purposes set
forth in this Agreement. This Agreement does not constitute a release of DOC Data for the
Recipient's discretionary use. DOC Data may be used only to carry out the purposes described
in this Agreement. Any ad hoc analyses or other use of the data, not specified in this Agreement,
is not permitted without the prior written agreement of DOC.
5.2. Recipient shall comply with the policies, standards, and guidelines of WaTech and all applicable
state and federal laws in its treatment of DOC Data and IT Resources, including, but not limited
to, WaTech SEC-08 Data Sharing Policy (formerly OCIO Standard 141.10); the Health Insurance
Portability and Accountability Act (HIPAA), Pub. L. 104-191, as amended by the Health
Information Technology for Economic and Clinical Health Act of 2009 (HITECH), 45 CFR Parts
160 and 164; the Family Educational Rights and Privacy Act (FERPA) 20 U.S.C. § 1232g;
Substance Abuse and Mental Health Services Administration regulations on Confidentiality of
Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; the Uniform Health Care Information
Act, chapter 70.02 RCW; the Washington State Criminal Records Privacy Act, chapter 10.97 RCW;
and Criminal Justice Information Services, 28 CFR Part 20.
5.3. Recipient understands and assumes all risks and liabilities of use and misuse of DOC Data by
Recipient.
5.4. Recipient will not use, publish, transfer, sell, or otherwise disclose any DOC Data gained by
reason of this Agreement for any purpose that is not directly connected with the purpose,
justification, and permitted uses of this Agreement, except as provided by law or with the prior
written consent of DOC and the individual or personal representative of the individual who is
the subject of the DOC Data, if any.
5.5. Recipient shall not use, transfer, sell, or otherwise disclose DOC Data for any commercial or
personal purpose.
5.6. Recipient shall not link DOC Data with other data sources without the prior written agreement
of DOC.
5.7. Recipients that are authorized to access DOC systems as part of their work may view and use
data only to fulfill the obligations of this Agreement. Unless explicitly authorized in writing,
Recipient may not update, change, take, or save images, or save or download any DOC Data in
Washington State K13566(2) Page 4 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
part or in full from any DOC system. Any such action to DOC Data shall be cause for immediate
termination of this Agreement.
5.8. Recipient shall not share DOC Data with a Third Party without prior written agreement of DOC.
5.9. Publication of DOC Data
5.9.1. Recipient may not publish reports or other materials using or based upon DOC Data
without DOC's prior written consent.
5.9.2. Any and all reports utilizing or derived from DOC Data shall be subject to review by DOC
prior to publication or presentation. Recipient shall provide all draft materials to DOC for
review of usability, data sensitivity, data accuracy, completeness, and consistency with
DOC standards at least twenty (20) working days prior to the presentation or publication
of any report utilizing or derived from DOC Data.
5.9.3. Recipient shall include the following statement with any publication utilizing or derived
from DOC Data:
"This material utilizes information from the Washington State Department
of Corrections (DOC). Any views expressed here are those of the author(s)
and do not necessarily represent those of the DOC or other data
contributors. Any errors are attributable to the author(s). DOC does not
guarantee the accuracy, timeliness, or completeness of the data/information
supplied."
5.10. Any data that is derived from DOC Data or which could not have been produced but for the use
of DOC Data shall be considered DOC Data and is subject to the terms and conditions set forth
in this Agreement.
5.11. The requirements in this section shall survive the termination or expiration of this Agreement or
any subsequent agreement intended to supersede this Agreement.
6. DATA SECURITY
6.1. Recipient shall exercise due care and take reasonable precautions to protect and maintain DOC
Data against unauthorized use, access, disclosure, modification, and loss. Recipient
acknowledges that DOC is relying on the administrative, physical, and technical safeguards
implemented by Recipient in permitting access to DOC Data. Recipient's administrative,
physical, and technical safeguards shall comply with all applicable laws, and applicable then
current privacy and security guidelines and/or standards issued by WaTech and National
Institute for Standards and Technology (NISTJ.
6.2. Workstation hard disk drives. Data stored on local workstation hard disks shall be encrypted
with a FIPS approved cryptographic algorithm. Access will be restricted to authorized users by
requiring logon to the local workstation using a unique user ID and complex password or other
authentication mechanisms that provide equal or greater security, such as biometrics or smart
cards.
Washington State K13566(2) Page 5 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
6.3. Network server disks. Data stored on hard disks mounted on network servers and made
available through shared folders shall be encrypted with a FIPS approved cryptographic
algorithm. Access to the data will be restricted to authorized users through the use of access
control lists which will grant access only after the authorized user has authenticated to the
network using a unique user ID and complex password or other authentication mechanisms
which provide equal or greater security, such as biometrics or smart cards. Data on disks
mounted to such servers must be located in an area which is accessible only to authorized
personnel, with access controlled through use of a key, card key, combination lock, or
comparable mechanism. Backup copies must be encrypted if recorded to removable media.
6.4. Optical discs (e.g., CDs, DVDs, Blu-Rays) in local workstation optical disc drives. Data provided
by DOC on optical discs that will be used in local workstation optical disc drives and will not be
transported out of a secure area shall be encrypted with a FIPS approved cryptographic
algorithm. When not in use, such discs must be locked in a drawer, cabinet or other container to
which only authorized users have the key combination, or mechanism required to access the
contents of the container. Workstations which access DOC Data on optical discs must be located
in an area accessible only to authorized individuals, with access controlled though use of key,
card key, combination lock, or comparable mechanism.
6.5. Optical discs (e.g., CDs, DVDs, Blu-Rays) in drives or other devices attached to a network. Data
provided by DOC on optical discs that will be used in drives or other devices attached to a
network shall be encrypted with a FIPS approved cryptographic algorithm. Access to data on
these discs will be restricted to authorized users through the use of access control lists which will
grant access only after the authorized user has authenticated to the network using a unique user
ID and complex password or other authentication mechanisms which provide equal or greater
security, such as biometrics or smart cards. The optical discs must be located in an area accessible
only to authorized individuals, with access controlled through use of a key, card key,
combination lock, or comparable mechanism.
6.6. Paper documents. Any paper records must be protected by storing the records in a secure area
accessible only to authorized individuals. When not in use, such records must be stored in a
locked container, such as a file cabinet,. locking drawer, or safe, to which only authorized persons
have access.
6.7. Portable Devices. Within this Agreement, portable devices include, but are not limited to
handhelds/PDAs, Ultramobile PCs, flash memory devices (e.g., USB flash drives, personal media
players), portable hard disks, and laptop/notebook computers. Portable media includes, but is
not limited to optical media (e.g., CD's, DVDs, Blu-Rays), magnetic media (e.g., floppy disks,
Zip or Jaz disks or drives), and flash media (e.g., Compact Flash, SD Card, MMC).
Recipient shall not store DOC Data on portable devices or portable media unless specifically
authorized within this Agreement. If so authorized, the Recipient shall:
• Encrypt the data with a FIPS approved cryptographic algorithm.
• Control access to devices with a unique user ID and password or stronger authentication
method such as a physical token or biometrics.
Washington State K13566(2) Page 6 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
• Manually lock devices whenever they are left unattended and set devices to lock
automatically after a period of inactivity, if this feature is available. Maximum period of
inactivity is twenty (20) minutes.
• Physically protect the portable device(s) and/or media by keeping them in locked storage
when unused; using check-in/check-out procedures when device or other media is being
shared; taking frequent inventories of media, and access to media by users.
When being transported outside of a secure area, portable devices and media with
confidential DOC Data must be under the physical control of Recipient's staff with
authorization to access the data.
6.8. Backup Data Storage
6.8.1. DOC Data may be stored on Portable Devices that meet the requirements for such storage
as part of Recipient's existing, documented backup process for business continuity or
disaster recovery purposes. Such storage is authorized until such time as that media
would be reused during normal backup operations. If backup media is retired while DOC
Data still exists upon it, such media will be destroyed at that time in accordance with the
disposition requirements of this Agreement.
6.8.2. Data may be stored on non -portable media (e.g., Storage Area Network drives, virtual
media, etc.) that meet the requirements for such storage as part of a Recipient's existing,
documented backup process for business continuity or disaster recovery purposes. If so,
such media will be protected as otherwise described in this Agreement. If this media is
retired while DOC Data still exists upon it, the DOC Data will be destroyed at that time in
accordance with the disposition requirements of this Agreement.
6.9. Cloud Storage. DOC Data requires protections equal to or greater than those specified in this
agreement. Cloud storage of DOC Data is problematic as neither DOC nor the Recipient has
control of the environment in which the DOC Data is stored. For this reason:
6.9.1. DOC Data will not be stored in any consumer grade Cloud solution, unless all of the
following conditions are met:
6.9.1.1. Recipient has written procedures in place and governing the use of Cloud storage and
Recipient attests in writing that all such procedures will be uniformly followed.
6.9.1.2. DOC Data will be Encrypted while within the Recipient's network.
6.9.1.3. DOC Data will remain Encrypted during transmission to the Cloud.
6.9.1.4. DOC Data will remain Encrypted at all times while residing within the Cloud storage
solution.
6.9.1.5. Recipient will possess a decryption key for the DOC Data and the decryption key will
be possessed only by Recipient and/or DOC.
6.9.1.6. DOC Data will not be downloaded to non -authorized systems, meaning systems that
are not on either the DOC network or Recipient's network.
Washington State K13566(2) Page 7 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
6.9.1.7. DOC Data will not be decrypted until downloaded onto a computer within the control
of an Authorized User and within either the DOC's network or Recipient's network.
6.9.2. DOC Data will not be stored on an Enterprise Cloud storage solution unless either:
6.9.2.1. The Cloud storage provider is treated as any other subcontractor and agrees in writing
to all the requirements within this Attachment; or
6.9.2.2. The cloud storage solution used is FedRAMP certified.
6.9.3. If DOC Data includes protected health information covered by the Health Insurance
Portability and Accountability Act (HIPAA), the Cloud provider must sign a Business
Associate Agreement prior to DOC Data being stored in their Cloud solution.
6.10. System Protection. Recipient shall exercise due care and take reasonable precautions to prevent
the compromise of systems which contact DOC Data and systems through which DOC Data
passes.
6.10.1. Systems containing DOC Data must have all security patches or hotfixes applied within
three (3) months after such patches or hotfixes are made available.
6.10.2. Recipient must have a process to ensure that the requisite patches and hotfixes have been
identified and applied within the required timeframe.
6.10.3. Systems containing DOC Data shall have anti-malware application installed, if such an
application is available.
6.10.4. Anti-malware software shall be kept up to date. The product, anti -virus engine, and any
malware database used will be no more than one (1) update behind the most current
version.
6.10.5. Recipient's patch management process must meet or exceed the then -current standards
promulgated by the National Institute of Standards and Technology (NISI), which may be
found at the time of drafting in NIST Special Publication 800-40.
6.10.6. The system architecture must provide continuous monitoring of both internal and external
activity for anomalies and identify, report, and defend against security intrusions before
data is compromised.
6.10.7. Recipient shall conduct penetration tests at least once every twenty-four (24) months,
system vulnerability assessments at least monthly, and application vulnerability
assessments prior to the production release of any changes to source code.
6.10.8. Requester's application/system development practices must be consistent with those
promulgated by NIST for low to moderate impact systems, which may be found in NIST
SP 800.64 at the time of drafting.
6.10.9. Recipient warrants that its application/system does not contain any of the Open Web
Application Security Project's top ten (10) vulnerabilities.
Washington State K13566(2) Page 8 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
6.10.10 Recipient has a practice of systematic collection, monitoring, alerting, maintenance,
retention, and disposal of security event logs and application audit trails. Logs and audit
trails are written to an area inaccessible to system users and are protected from editing. At
a minimum, the logs and audit trails must provide historical details on all transactions
within the system that are necessary to reconstruct activities, including, but not limited to,
recording the type of event, date, time, account identification, and machine identifiers for
each logged transaction. Audit and log files can be analyzed by type in order to find
emerging, issues or trends. Recipient's system must trigger immediate notification to
appropriate system administrators for severe incidents. Logs must be secured against
unauthorized changes. Logs must be retained for at least six (6) months.
6.11. Additional Safeguards Against Unauthorized Use and Disclosure of DOC Data. Recipient shall
exercise due care to protect all data from unauthorized physical and electronic access. Recipient
shall establish and implement the following minimum physical, electronic, and managerial
safeguards for maintaining the confidentiality of DOC Data obtained pursuant to this
Agreement:
6.11.1. Recipient will restrict access to DOC Data to only those authorized staff, employees,
officials, and agents that need it to perform their duties under this Agreement.
6.11.2. Recipient will store the information in an area that is safe from access by unauthorized
persons during work hours as well as non -work hours, or when otherwise not in use.
6.11.3. Recipient will design, implement and maintain an information security program designed
to meet at least an industry standard ability to protect the information in a manner that
prevents unauthorized persons from retrieving the information by means of computer,
remote terminal, or other means.
6.11.4. Recipient shall, at a minimum, meet or exceed the requirements set forth in WaTech's
policies and standards for data security and access controls to ensure the confidentiality,
availability, and integrity of all data accessed.
6.11.5. Recipient must implement policies and procedures that limit DOC Data disclosed to
individuals to the minimum amount reasonably necessary to achieve the purpose of the
disclosure as described in this Agreement.
7. DATA SEGREGATION
7.1. DOC Data provided pursuant to this Agreement must be segregated or otherwise
distinguishable from non-DOC Data. This requirement ensures that all DOC Data can be
identified for return or destruction upon expiration, termination, or completion of work under
this Agreement. It also aids in determining whether DOC Data has or may have been
compromised in the event of a security breach.
7.2. Methods of Data Segregation.
7.2.1. Electronic Media. If DOC Data is stored on electronic media (e.g., hard disk, optical disc,
magnetic tape):
Washington State K13566(2) Page 9 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
a. Such electronic media shall contain only DOC Data; or
b. DOC Data shall be stored in a partition or folder or other logical container
dedicated to DOC Data.
7.2.2. Database. If DOC Data is stored in a database:
a. Such database shall contain only DOC Data; or
b. DOC Data shall be distinguishable from non-DOC Data by the value of a specified
field or fields within database records.
7.2.3. Paper Documents. If DOC Data is stored as physical paper documents, such documents
shall be physically segregated from non-DOC Data and secured in a drawer, folder, or
other container, with access limited to only authorized individuals.
7.3. When it is not feasible or practical to segregate DOC Data from non-DOC Data using the methods
set forth above, then both the DOC Data and the non-DOC Data with which it is commingled
must be protected as described for DOC Data in this Agreement.
8. DATA CONFIDENTIALITY
8.1. Recipient acknowledges the personal or confidential nature of the information and agrees that
all employees, agents, volunteers, contractors, and subcontractors with access to DOC Data, and
third parties with whom DOC Data is shared, shall comply with all laws, regulations, and
policies that apply to protection of the confidentiality of the DOC Data. Recipient is responsible
for ensuring all such employees, agents, volunteers, contractors, subcontractors, and third parties
are aware of and abide by the data use and security provisions set forth in this Agreement and
any amendments, attachments, or exhibits hereto. Recipient is responsible for timely providing
the Department with duly executed Statements of Confidentiality and Non -Disclosure and
Certifications of Data Disposition for all such employees, agents, volunteers, contractors,
subcontractors, and third parties. Recipient acknowledges that the failure to meet the
requirements set forth in this section is, at DOC's discretion, cause for termination.
8.2. Each individual with access to DOC Data shall read and sign a Statement of Confidentiality and
Non -Disclosure (Exhibit E-1). A copy of an individual's properly executed Statement of
Confidentiality and Non -Disclosure shall be sent to the DOC Agreement Administrator before
that individual is permitted access to DOC Data.
8.3. DOC may, at its reasonable discretion, disqualify an otherwise authorized individual from
accessing DOC Data. Such a Notice of Disqualification shall be in writing and shall terminate a
disqualified individual's access to DOC Data immediately upon delivery to Recipient. The
disqualification of one or more individuals by DOC does not affect other individuals authorized
by or pursuant to this Agreement.
9. DISPOSITION OF DATA
9.1. Time of Disposal. Recipient shall immediately dispose of DOC Data upon the occurrence of any
of the following:
Washington State K13566(2) Page 10 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
a. Immediately in the event the Agreement is terminated for cause or convenience;
b. Immediately upon completion of work that required the DOC Data; and
c. Within one (1) year from the date the DOC Data was made available to Recipient.
9.2. Method of Disposal. At DOC's option, the disposal required in this section may be accomplished
by the destruction of DOC Data, the return of DOC Data to DOC, or a combination of both.
Recipient shall perform all other actions DOC determines necessary to protect DOC Data. If
DOC does not specify a preferred method of disposal, Recipient shall destroy the DOC Data.
9.3. Certification of Data Disposition. Recipient shall provide a completed Certification of Data
Disposition (Exhibit E-2) confirming the disposal of all DOC Data to the DOC Contract Manager
within fifteen (15) days of the date of disposal. Recipient shall also ensure that all DOC Data
shared with other entities under this Agreement is disposed of in accordance with the provisions
of this section and provide DOC with a written Certification of Data Disposition from the entity
that possessed such data confirming the disposal of all DOC Data within fifteen (15) days of the
date of disposal. The failure to dispose of DOC Data as set forth in this Agreement may prevent
future data share agreements with Recipient and other entities permitted to use DOC Data under
the terms of this Agreement.
9.4. Methods of Destruction.
9.4.1. Paper Documents.
9.4.1.1. Paper documents containing Category 3 data may be recycled by a contracted
recycling firm, provided that the contract ensures the confidentiality of the data will
be protected. Such documents may also be destroyed by on -site shredding, pulping,
or incineration.
9.4.1.2. Paper documents containing Category 4 data shall be destroyed by on -site shredding,
pulping, or incineration.
9.4.2. Optical Discs. Optical discs containing Category 3 or Category 4 data shall be destroyed
by on -site incineration, shredding, or complete defacement of the readable surface with a
coarse abrasive.
9.4.3. Magnetic Tapes. Magnetic tapes containing Category 3 or Category 4 data shall be
destroyed by incineration, crosscut shredding, or degaussing.
9.4.4. Server and Workstation Hard Drives. Category 3 and Category 4 data stored on server
and workstation hard drives, and other similar media, shall be destroyed by a data erasure
or sanitation utility that overwrites the data at least three (3) times using either random or
single character data, the degaussing of the hard drive or media sufficient to ensure that
the data cannot be retrieved or reconstructed, or the complete physical destruction of the
hard drive or media such that the content cannot be retrieved or reconstructed.
9.4.5. Portable Media. Category 3 and Category 4 data stored on portable media shall be
destroyed by a data erasure or sanitation utility that overwrites the data at least three (3)
Washington State K13566(2) Page 11 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
times using either random or single character data, the complete degaussing of the
portable media sufficient to ensure that the data cannot be retrieved or reconstructed, or
the complete physical destruction of the portable media such that the content cannot be
retrieved or reconstructed.
9.4.6. The requirements of this section shall survive the termination or expiration of this
Agreement and any subsequent agreement intended to supersede this Agreement.
10. INCIDENT NOTIFICATION AND RESPONSE
10.1. The compromise or potential compromise of DOC Data that maybe a breach that requires notice
to affected individuals under RCW 42.56.590, RCW 19.255.010, or any other applicable breach
notification law or rule must be reported to the DOC Contract Manager, DOC Privacy Officer,
and DOC Chief Information Security Officer in writing within one (1) business day of discovery.
10.2. Incidents that may require notice to affected individuals under RCW 42.56.590 or RCW
19.255.010 include, but are not limited to, unauthorized access to any of the following:
10.2.1. If associated with a first name (or initial) and last name:
a. Full or last four digits of social security number.
b. Driver's license or Washington identification card number.
C. Account number, credit or debit card number, or any required security code,
access code, or password that would permit access to an individual's financial
account.
d. Full date of birth.
e. Private key that is unique to an individual and that is used to authenticate or sign
an electronic record.
f. Student, military, or passport identification number.
g. Health insurance policy number or health insurance identification number.
h. Information about medical history, health condition, or a health care professional's
diagnosis or treatment.
i. Biometric data generated by automatic measurements of an individual's biological
characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique
biological patterns or characteristics that is used to identify a specific individual.
10.2.2. Username or email address, together with a password or security questions and answers
that would allow access to an online account.
Washington State K13566(2) Page 12 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
10.3. If Recipient does not have full details about the incident, it will report what information it has
and provide full details as soon as possible but no later than ten (10) business days after the date
of discovery. To the extent possible, these initial reports must include at least:
10.3.1. The nature of the unauthorized use or disclosure, including a brief description of the event
of unauthorized use or disclosure, the date of the event, and the date of discovery.
10.3.2. A description of the types of information involved.
10.3.3. The investigative and remedial actions Recipient or its subcontractor took or will take to
prevent and mitigate harmful effects and protect against recurrence.
10.3.4. Any details necessary for a determination of whether the incident is a breach that requires
notification under RCW 19.255.010, RCW 42.56.590, or any other applicable breach
notification law or rule.
10.3.5. Any other information DOC reasonably requests.
10.4. As soon as reasonably practicable, Recipient must also take actions to mitigate the risk of loss
and comply with any notification or other requirements imposed 'by law or DOC.
10.5. If, in the sole judgment of DOC, notifications to individuals must be made, Recipient will further
cooperate and facilitate notification to required parties, which may include notification to
affected individuals, the media, the Attorney General's Office, or other authorities based on
applicable law.
At DOC's discretion, Recipient may be required to directly fulfill notification requirements, or if
DOC elects to perform the notifications, Recipient must reimburse DOC for all associated costs.
10.6. Recipient is responsible for all costs incurred in connection with a security incident, privacy
breach, or potential compromise of DOC Data, including, but not limited to:
10.6.1. Computer forensics assistance to assess the impact of a data breach, determine root cause,
and help determine whether and the extent to which notification must be provided to
comply with breach notification laws.
10.6.2. Notification and call center services for individuals affected by a security incident or
privacy breach, including fraud prevention, credit monitoring, and identity theft
assistance.
10.6.3. Regulatory defense, fines, and penalties from any claim in the form of a regulatory
proceeding resulting from a violation of any applicable privacy or security laws or
regulations.
10.6.4. Recipient's obligations regarding incident notification survive the termination of this Agreement
and continue for as long as Recipient maintains DOC Data and for any breach or potential breach,
at any time.
11. INTELLECTUAL PROPERTY RIGHTS
Washington State K13566(2) Page 13 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
Unless otherwise provided herein, this Agreement will not be construed to effect any transfer of right or
license to the embodiments of DOC Data, except to the minimum extent necessary to carry out the
responsibilities specified herein. Ownership of any reports, publications, research results and the
embodiments thereof shall follow U.S. Patent and Copyright law. DOC is granted a royalty -free,
irrevocable license to reproduce, publish, or otherwise use, and to authorize others to use any such reports,
publications, research results and the embodiments thereof for government purposes.
12. OFFSHORE PROHIBITION
Recipient must maintain all DOC Data in the United States. Recipient may not directly or indirectly
(including through subcontractors) transport or maintain any DOC Data outside the United. States unless
Recipient has advance written approval from the Department.
Washington State K13566(2) Page 14 of 14
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-81 1 O-DBFFEAF98FEA
EXHIBIT E-1
STATEMENT OF CONFIDENTIALITY AND NON -DISCLOSURE
Between
Washington State Department of Corrections
And
COUNTERPARTY NAME
DOC Contract No. K13566(2)
As an employee or agent of Recipient, I will have access to sensitive and confidential information ("DOC
Data") provided by the Washington State Department of Corrections ("DOC.") pursuant uant to the above -
referenced contract. Therefore:
I agree to protect the confidentiality of all DOC Data obtained pursuant to the above -referenced contract.
I agree to use DOC Data solely for the purposes set forth in the above -referenced contract and only to the
extent necessary to perform my assigned duties as an employee or agent of Recipient.
I agree not to divulge, transfer, sell, or otherwise make known to unauthorized persons any DOC Data.
I agree not to access or use DOC Data for my own personal purposes.
I agree to abide by all federal and state laws and regulations regarding confidentiality and disclosure of the
information related to the above -referenced contract.
Employee Supervisor
I have read and understand the The employee has been informed of
above Notice of Nondisclosure of their obligations including any
information. limitations, use or publishing of
confidential data.
Signature
Printed Name Click or tap here to enter text.
Organization Click- or -tap here to enter text.
Job Title Click or tap here to enter text.
Email Address Click or tap here to enter text.
Date Click, or tap to enter a date.
Click or tap here to enter text.
Click or tap here to enter text.
Click or tap here to enter text.
Click or tap here to enter text.
Click or tap to enter a date.
Washington State K1 3566(2) Page 1 of 1
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-81 1 O-DBFFEAF98FEA
CERTIFICATION OF DATA DISPOSITION
Date of Disposition:
Data Recipient:
EXHIBIT E-2
Contract K13566 (2)
As a recipient of DOC Data disseminated pursuant to the above -referenced Agreement, you must timely
dispose of DOC Data in accordance with the terms of the Agreement and provide the DOC Contract
Manager with a completed Certification of Data Disposition within fifteen (15) days of the date of disposal.
❑ Paper Documents: DOC Data obtained pursuant to the above -referenced Agreement was stored
on Paper Documents, as that term is used in the Agreement. All such DOC Data was destroyed in
accordance with the terms of the Agreement.
❑ Optical Discs: DOC Data obtained pursuant to the above -referenced Agreement was stored on
Optical Discs, as that term is used in the Agreement. All such DOC Data was destroyed in accordance with
the terms of the Agreement.
❑ Magnetic Tapes: DOC Data obtained pursuant to the above -referenced. Agreement was stored on
Magnetic Tapes, as that term is used in the Agreement. All such DOC Data was destroyed in accordance
with the terms of the Agreement.
❑ Server and Workstation Hard Drives: DOC Data obtained pursuant to the above -referenced
Agreement was stored on Server and Workstation Hard Drives, as those terms are used in the Agreement.
All such DOC Data was destroyed in accordance with the terms of the Agreement.
❑ Portable Media: DOC Data obtained pursuant to the above -referenced Agreement was stored on
Portable Media, as that term is used in the Agreement. All such DOC Data was destroyed in accordance
with the terms of the Agreement.
The Data Recipient hereby certifies, by signature below, that all DOC Data obtained pursuant to the above -
referenced Agreement has been disposed of in accordance with the terms of the Agreement.
Signature of Data Recipient
Printed Name and Title
Date
Washington State K13566(2) Page 1 of 1
Department of Corrections 26RCP
Docusign Envelope ID: 32B74476-FB39-8FEA-8110-DBFFEAF98FEA
VARIABLE LIST
1. Name
2. DOC Number
EXHIBIT E-3
Washington State K13566(2) Page 2 of 1
Department of Corrections 26RCP