Sensitive Information Information that requires special precautions to protect from unauthorized use, access, disclosure, modification, loss, or deletion. Sensitive Information may be either Public Information or Confidential Information. It is information that requires a higher than normal assurance of accuracy and completeness. Thus, the key factor for Sensitive Information is that of integrity. Typically, Sensitive Information includes records of agency financial transactions and regulatory actions.
Access to Company Information (a) During the period from the date of this Agreement to the Effective Time, the Company shall permit representatives of the Parent to have reasonable access (at all reasonable times, and in a manner so as not to interfere with the normal business operations of the Company) to all premises, properties, financial and accounting records, contracts, other records and documents, and personnel, of or pertaining to the Company. (b) The Parent and each of its Subsidiaries (i) shall treat and hold as confidential any Company Confidential Information (as defined below), (ii) shall not use any of the Company Confidential Information except in connection with this Agreement, and (iii) if this Agreement is terminated for any reason whatsoever, shall return to the Company all tangible embodiments (and all copies) thereof which are in its possession. For purposes of this Agreement, “Company Confidential Information” means any information of the Company that is furnished to the Parent or any of its Subsidiaries by the Company in connection with this Agreement; provided, however, that it shall not include any information (A) which, at the time of disclosure, is available publicly other than as a result of non-permitted disclosure by the Parent, any of its Subsidiaries or their respective directors, officers, or employees, (B) which, after disclosure, becomes available publicly through no fault of the Parent, any of its Subsidiaries or their respective directors, officers, or employees, (C) which the Parent or any of its Subsidiaries knew or to which the Parent or any of its Subsidiaries had access prior to disclosure, as demonstrated by competent evidence, provided that the source of such information is not known by the Parent or any of its Subsidiaries to be bound by a confidentiality obligation to the Company, or (D) which the Parent or any of its Subsidiaries rightfully obtains from a source other than the Company, provided that the source of such information is not known by the Parent or any of its Subsidiaries to be bound by a confidentiality obligation to the Company.
Handling Sensitive Personal Information and Breach Notification A. As part of its contract with HHSC Contractor may receive or create sensitive personal information, as section 521.002 of the Business and Commerce Code defines that phrase. Contractor must use appropriate safeguards to protect this sensitive personal information. These safeguards must include maintaining the sensitive personal information in a form that is unusable, unreadable, or indecipherable to unauthorized persons. Contractor may consult the “Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals” issued by the U.S. Department of Health and Human Services to determine ways to meet this standard. B. Contractor must notify HHSC of any confirmed or suspected unauthorized acquisition, access, use or disclosure of sensitive personal information related to this Contract, including any breach of system security, as section 521.053 of the Business and Commerce Code defines that phrase. Contractor must submit a written report to HHSC as soon as possible but no later than 10 business days after discovering the unauthorized acquisition, access, use or disclosure. The written report must identify everyone whose sensitive personal information has been or is reasonably believed to have been compromised. C. Contractor must either disclose the unauthorized acquisition, access, use or disclosure to everyone whose sensitive personal information has been or is reasonably believed to have been compromised or pay the expenses associated with HHSC doing the disclosure if: 1. Contractor experiences a breach of system security involving information owned by HHSC for which disclosure or notification is required under section 521.053 of the Business and Commerce Code; or 2. Contractor experiences a breach of unsecured protected health information, as 45 C.F.R. §164.402 defines that phrase, and HHSC becomes responsible for doing the notification required by 45 C.F.R. §164.404. HHSC may, at its discretion, waive Contractor's payment of expenses associated with HHSC doing the disclosure.
Access to Protected Information If BA maintains a designated record set on behalf of CE, BA shall make Protected Information maintained by BA or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within five (5) days of a request by CE to enable CE to fulfill its obligations under state law [Health and Safety Code Section 123110] and the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.524 [45 C.F.R. Section 164.504(e)(2)(ii)(E)]. If BA maintains Protected Information in electronic format, BA shall provide such information in electronic format as necessary to enable CE to fulfill its obligations under the HITECH Act and HIPAA Regulations, including, but not limited to, 42 U.S.C. Section 17935(e) and 45 C.F.R. Section 164.524.
Sensitive data Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.