Yuba County Jail Ceiling Restoration Project

COUNTY OF YUBA
CONFIDENTIALITY PROVISIONS AND STATEMENTS
1 INTRODUCTION.
For the purposes of solicitation, purchasing, contracts, and supporting documentation for
services to be provided, (hereinafter "CONTRACTOR"), the COUNTY has provided the
CONTRACTOR access to confidential information. The provisions and statements set forth in
this document outline the CONTRACTOR's responsibilities for safeguarding this information.
2 DEFINITIONS.
2.1 CONFIDENTIAL INFORMATION shall include, but is not limited to, personally
identifiable information, protected health information, financial information, financial
account numbers, driver's license numbers, social security numbers, marital status, etc.
2.2 PERSONALLY IDENTIFIABLE INFORMATION is confidential information and
includes, but is not limited to, names, dates of birth, social security numbers, addresses,
phone numbers, driver's license numbers, State ID numbers, etc.
2.3 BREACH shall mean the acquisition, access, use or disclosure of confidential
information which compromises the security or privacy of such information.
2.4 SECURITY INCIDENT shall mean any known successful or unsuccessful attempt by
an authorized or unauthorized individual to inappropriately use, disclose, modify, access,
or destroy any confidential information.
3 BACKGROUND.
The COUNTY maintains confidential information to perform functions, activities, and/or
services directly related to the administration of a social service program. Such confidential
information may not be used, accessed, or disclosed for any other purposes.
The COUNTY must take appropriate steps to ensure its compliance with all applicable
state and federal confidentiality laws and desires to protect the privacy of those to which it provides
services. As such, it must require that CONTRACTOR also obey all applicable state and federal
laws. Any individual who violates the privacy, confidentiality, or security of confidential
information in any form or medium may be subject to civil and/or criminal prosecution under state
and federal law.
Establishing safeguards for confidential information can limit the potential exposure of
confidential information and CONTRACTOR is expected to adhere to current industry standards
and best practices in the management of data collected by, or on behalf of, the COUNTY, and
within the CONTRACTOR's possession.

However, even with sound practices and safeguards, exposure can occur as a result of a
theft, loss, compromise or breach of the data and/or systems containing data. At these times, the
CONTRACTOR must immediately report the incident surrounding the loss or breach of data in
the CONTRACTOR's possession and absorb any associated costs as deemed by the COUNTY to
be reasonable and necessary.
4 PROVISIONS.
4.1 The CONTRACTOR shall sign the "Confidentiality Provisions and Statements" and
adopt it by reference in the underlying Agreement.
4.2 The COUNTY requires at least the following minimum standards of care in handling
the confidential information:
4.2.1 Securing all areas where confidential information is maintained and/or stored;
4.2.2 Utilizing all industry standard encryption and methodology through which
confidential information is transmitted and/or stored. This includes desktop and
laptop computers (whole drive encryption - not file encryption), personal digital
assistants (PDA), smart phones, thumb or flash-type drives, CDs, diskettes, backup
tapes, etc.;
4.2.3 Limiting the removal of confidential information from the CONTRACTOR's
premises except for those purposes as designated in the underlying Agreement;
4.2.4 Ensuring only the minimum necessary amount of confidential information is
downloaded and/or accessed when absolutely necessary for the purposes as
designated in the underlying Agreement;
4.2.5 Not leaving unattended or accessible to unauthorized individuals; and
4.2.6 Disposing of confidential information, after obtaining COUNTY
authorization and approval, through confidential means for the purposes designated
in the underlying Agreement.
4.3 Confidential information shall only be used or disclosed for the purposes designed in
the underlying Agreement and at no time shall be disclosed or used for personal, non-
contract/agreement related reasons, unless specifically authorized by the COUNTY.
4.4 In all circumstances, the CONTRACTOR shall have no ownership rights or interests
in any data or information, including confidential information. All data collected by the
CONTRACTOR on behalf of the COUNTY, or received by the CONTRACTOR on behalf
of the COUNTY, is owned by the COUNTY. There are no exceptions to this provision.

4.5 The COUNTY may periodically monitor and/or audit use of the information systems
and other record-keeping systems at a CONTRACTOR's location or COUNTY location in
an effort to ensure compliance with these provisions.
4.6 If there is an incident involving theft, loss, compromise, and/or breach of confidential
information, the CONTRACTOR must notify the COUNTY immediately and under no
circumstances no less than twenty-four (24) hours after discovery of such an incident.
4.7 If the incident involves a theft or is incidental to another crime, the CONTRACTOR
shall notify the appropriate law enforcement officials and a police report generated to
document the circumstances of the incident so as to establish whether the crime involved
a motive to obtain the confidential information. The police report will be forwarded to the
COUNTY within forty-eight (48) hours of receipt of the report.
4.8 NOTIFICATION OF BREACH.
4.8.1 Upon the suspicion or discovery of a breach, security incident, intrusion, or
unauthorized use or disclosure of confidential information, the CONTRACTOR
shall notify the COUNTY within twenty-four (24) hours by telephone in addition
to follow up by either email or fax.
4.8.2 Notification of any breach, security incident, or unauthorized access as
described in section 4.8.1 shall be provided to:
Perminder Bains, Director of Administrative Services
Phone: (530) 749-7880
E-Mail: pbains@yuba.gov
Fax: (530) 749-7894
4.8.3 The CONTRACTOR shall immediately investigate such actual or suspected
breach, security incident, or unauthorized access of confidential information.
Within seventy-two (72) hours of the discovery, if an actual breach has occurred,
the CONTRACTOR shall notify the individual identified in section 4.8.2 of the
following:
(a) What data elements were involved and the extent of the data involved
in the breach (e.g. number of records or affected individual's data);
(b) The identity of the unauthorized persons known or reasonably
believed to have improperly used or disclosed Personally Identifiable
Information and/or confidential information;
(c) A description of where the confidential information is believed to
have been improperly transmitted, sent, or utilized;

(d) A description of the probable causes of the improper use or disclosure;
and
(e) Whether any state or federal laws requiring individual notifications of
breaches are triggered.
4.8.4 The COUNTY will coordinate with the CONTRACTOR to determine
additional specific actions that will be required of the CONTRACTOR for
mitigation of the breach, which may include notification to the individual or other
authorities.
4.8.5 All associated costs shall be borne by the CONTRACTOR. This may
include, but is not limited to, costs associated with notifying the affected
individuals.
4.9 The COUNTY may require that the CONTRACTOR provide evidence of adequate
background checks for individuals who are entrusted by the CONTRACTOR to work with
the COUNTY's confidential information.
4.10 The COUNTY requires that the CONTRACTOR have comprehensive policies and
procedures to adequately safeguard the confidential information before it is conveyed to
the CONTRACTOR. The CONTRACTOR's policies should articulate all safeguards in
place for the COUNTY's confidential information, including provisions for destruction of
all data and backup copies of data. All COUNTY-owned media containing confidential
information shall be returned to the COUNTY when no longer legitimately needed by the
CONTRACTOR.

ACKNOWLEDGEMENT OF RECEIPT AND SIGNATURE.
The CONTRACTOR hereby understands the above provisions and statements. The
CONTRACTOR further understands the sensitivity of the confidential information and
understands that the CONTRACTOR must protect the confidentiality of all COUNTY information
placed within the CONTRACTOR's care or which the CONTRACTOR may come across during
the course of the Agreement.
DATED: ___________
CONTRACTOR
(Signature)
(Print Name and Title)

WAIVER AND GENERAL RELEASE RE:
VENDOR ACCESS TO COUNTY OF YUBA PROPERTIES
In consideration of receiving a limited and permissive right to enter COUNTY OF YUBA properties, IT IS
AGREED THAT the undersigned hereby release the COUNTY OF YUBA, its agents, officers, directors,
attorneys and employees (collectively referred to hereinafter as "COUNTY") to the greatest extent provided for
under law for the following matters that arise in any way out of the activities specified herein:
1. Any and all claims for personal injury or death to the undersigned, whether or not caused in whole or in
part by the negligence or other acts or omissions of COUNTY, except for COUNTY's active
negligence, and regardless of whether such injury is caused in whole or in part by the undersigned,
whether alone or together with or in association with others;
2. Any and all claims for any real or personal property damage, whether or not the property is owned by or
in the custody or possession of the undersigned, and whether or not caused by COUNTY or others,
except for COUNTY's active negligence, and regardless of whether the damage is caused in whole or in
part by the undersigned;
3. Any and all claims for any damage, injury, loss, expense or liability incurred or arising from any act or
omission of the COUNTY, any individual, company or agency in relation to transportation services to or
from COUNTY facilities; and
4. Any and all claims for any damage, injury, loss, accident, delay, irregularity, indebtedness, expense or
liability incurred or arising from weather, illness, or federal, state, county or COUNTY rule, regulation
or restriction.
IT IS FURTHER AGREED that the undersigned will, to the greatest extent authorized under law, indemnify,
defend, hold harmless and release the COUNTY from any and all claims, demands, actions, and damages,
including but not limited to attorneys' fees and reasonable costs, brought against the COUNTY for any injury
arising out of or caused by the undersigned's negligence or any acts, omissions or conduct of the undersigned in
relation to and arising out of the activities specified in this Waiver and General Release.
IT IS FURTHER AGREED that the undersigned understands, consents, and agrees to the terms and conditions
set forth above, and that his/her consent and agreement to this Waiver and General Release is a condition
precedent to COUNTY's grant of a limited and permissive right of entry.
The foregoing is agreed to this _______ day of _________________________, 20___:
PRINTED NAME ____________________________________ COMPANY NAME _____________________________________
PHONE NUMBER ___________________________________ EMAIL _______________________________________________
SIGNATURE _______________________________________________________________________________________________